Skip to content

Commit

Permalink
NFC: pn533: Fix missing lock while operating on commands list
Browse files Browse the repository at this point in the history
In pn533_wq_cmd command was removed from list without cmd_lock held
(race with pn533_send_cmd_frame_async) which could lead to list
corruption. Delete command from list before releasing lock.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
  • Loading branch information
Szymon Janc authored and Samuel Ortiz committed Nov 19, 2012
1 parent 16a78e9 commit 60ad07a
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion drivers/nfc/pn533.c
Original file line number Diff line number Diff line change
Expand Up @@ -698,13 +698,14 @@ static void pn533_wq_cmd(struct work_struct *work)

cmd = list_first_entry(&dev->cmd_queue, struct pn533_cmd, queue);

list_del(&cmd->queue);

mutex_unlock(&dev->cmd_lock);

__pn533_send_cmd_frame_async(dev, cmd->out_frame, cmd->in_frame,
cmd->in_frame_len, cmd->cmd_complete,
cmd->arg, cmd->flags);

list_del(&cmd->queue);
kfree(cmd);
}

Expand Down

0 comments on commit 60ad07a

Please sign in to comment.