Patchwork [3.5.y.z,extended,stable] Patch "staging: comedi: comedi_test: fix race when cancelling" has been added to staging queue

mail settings
Submitter Herton Ronaldo Krzesinski
Date Jan. 23, 2013, 4:42 a.m.
Message ID <>
Download mbox | patch
Permalink /patch/214751/
State New
Headers show


Herton Ronaldo Krzesinski - Jan. 23, 2013, 4:42 a.m.
This is a note to let you know that I have just added a patch titled

    staging: comedi: comedi_test: fix race when cancelling

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see



From ccf267832d9fac3ad7dfae552ad7b757c6ab88dc Mon Sep 17 00:00:00 2001
From: Ian Abbott <>
Date: Fri, 4 Jan 2013 11:33:21 +0000
Subject: [PATCH] staging: comedi: comedi_test: fix race when cancelling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit c0729eeefdcd76db338f635162bf0739fd2c5f6f upstream.

Éric Piel reported a kernel oops in the "comedi_test" module.  It was a
NULL pointer dereference within `waveform_ai_interrupt()` (actually a
timer function) that sometimes occurred when a running asynchronous
command is cancelled (either by the `COMEDI_CANCEL` ioctl or by closing
the device file).

This seems to be a race between the caller of `waveform_ai_cancel()`
which on return from that function goes and tears down the running
command, and the timer function which uses the command.  In particular,
`async->cmd.chanlist` gets freed (and the pointer set to NULL) by
`do_become_nonbusy()` in "comedi_fops.c" but a previously scheduled
`waveform_ai_interrupt()` timer function will dereference that pointer
regardless, leading to the oops.

Fix it by replacing the `del_timer()` call in `waveform_ai_cancel()`
with `del_timer_sync()`.

Signed-off-by: Ian Abbott <>
Reported-by: Éric Piel <>
Signed-off-by: Greg Kroah-Hartman <>
[ herton: adjust context ]
Signed-off-by: Herton Ronaldo Krzesinski <>
 drivers/staging/comedi/drivers/comedi_test.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)



diff --git a/drivers/staging/comedi/drivers/comedi_test.c b/drivers/staging/comedi/drivers/comedi_test.c
index 873e374..806c397 100644
--- a/drivers/staging/comedi/drivers/comedi_test.c
+++ b/drivers/staging/comedi/drivers/comedi_test.c
@@ -398,7 +398,7 @@  static int waveform_ai_cancel(struct comedi_device *dev,
 			      struct comedi_subdevice *s)
 	devpriv->timer_running = 0;
-	del_timer(&devpriv->timer);
+	del_timer_sync(&devpriv->timer);
 	return 0;