linux-kernel - Re: [RFC] iio: Release irq if set_trigger

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 1 May 2016 20:11:02 +0100
From:	Jonathan Cameron <jic23@...nel.org>
To:	Crestez Dan Leonard <leonard.crestez@...el.com>,
	linux-iio@...r.kernel.org
Cc:	linux-kernel@...r.kernel.org, Hartmut Knaack <knaack.h@....de>,
	Lars-Peter Clausen <lars@...afoo.de>,
	Peter Meerwald-Stadler <pmeerw@...erw.net>,
	Daniel Baluta <daniel.baluta@...el.com>
Subject: Re: [RFC] iio: Release irq if set_trigger_state fails

On 28/04/16 17:40, Crestez Dan Leonard wrote:
> When attaching a pollfunc iio_trigger_attach_poll_func will allocate a
> virtual irq and call the driver's set_trigger_state function. Fix error
> handling to release the irq if set_trigger_state fails.
> 
> Otherwise when using triggered buffers and the driver's
> set_trigger_state fails once then the buffer becomes unusable.
> 
> It is not possible to handle this sort of error by calling
> iio_trigger_detach_poll_func externally somehow. That function should
> only be called if attach is successful.
> 
> Signed-off-by: Crestez Dan Leonard <leonard.crestez@...el.com>
I'm embarrassed :(  good find! Not sure why you made such an obvious
bug fix an RFC though! 

Slight issue in the new error handling though I think..

Jonathan
> ---
> 
> I ran into this while adding some validation in driver's set_trigger_state
> function. It's much better to use buffer_ops->predisable for that kind of stuff
> but the iio core should still handle set_trigger_state errors correctly.
> 
>  drivers/iio/industrialio-trigger.c | 15 ++++++++++-----
>  1 file changed, 10 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c
> index ae2806a..cf2be3e 100644
> --- a/drivers/iio/industrialio-trigger.c
> +++ b/drivers/iio/industrialio-trigger.c
> @@ -214,18 +214,23 @@ static int iio_trigger_attach_poll_func(struct iio_trigger *trig,
>  	ret = request_threaded_irq(pf->irq, pf->h, pf->thread,
>  				   pf->type, pf->name,
>  				   pf);
> -	if (ret < 0) {
> -		module_put(pf->indio_dev->info->driver_module);
> -		return ret;
> -	}
> +	if (ret < 0)
> +		goto out_put_module;
>  
>  	if (trig->ops && trig->ops->set_trigger_state && notinuse) {
>  		ret = trig->ops->set_trigger_state(trig, true);
>  		if (ret < 0)
> -			module_put(pf->indio_dev->info->driver_module);
> +			goto out_put_irq;
>  	}
>  
>  	return ret;
> +
> +out_put_irq:
> +	iio_trigger_put_irq(trig, pf->irq);
> +	free_irq(pf->irq, pf);
> +out_put_module:
I think the iio_trigger_put_irq should be here as it will have been gotten before the 
request_threaded_irq call and hence should always be unwound on error not just in the
case above.
> +	module_put(pf->indio_dev->info->driver_module);
> +	return ret;
>  }
>  
>  static int iio_trigger_detach_poll_func(struct iio_trigger *trig,
>