linux-kernel - Race condition in TPA6130A2 (Was: Re: Nokia N900

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20160401104333.GC8413@pali>
Date:	Fri, 1 Apr 2016 12:43:33 +0200
From:	Pali Rohár <pali.rohar@...il.com>
To:	Sebastian Reichel <sre@...nel.org>,
	Peter Ujfalusi <peter.ujfalusi@...com>,
	Jarkko Nikula <jarkko.nikula@...mer.com>
Cc:	Tony Lindgren <tony@...mide.com>,
	Lars-Peter Clausen <lars@...afoo.de>,
	linux-kernel@...r.kernel.org, linux-omap@...r.kernel.org,
	Pavel Machek <pavel@....cz>,
	Aaro Koskinen <aaro.koskinen@....fi>,
	Nishanth Menon <nm@...com>,
	Ivaylo Dimitrov <ivo.g.dimitrov.75@...il.com>,
	merlijn@...zup.org
Subject: Race condition in TPA6130A2 (Was: Re: Nokia N900 - audio TPA6130A2
 problems)

On Wednesday 16 March 2016 15:47:10 Sebastian Reichel wrote:
> I just had another look at the driver and I think there is a race
> condition for tpa6130a2_add_controls() and tpa6130a2_stereo_enable().
> 
> As far as I can see both functions check for "tpa6130a2_client !=
> NULL". tpa6130a2_client is set before the probe function has finished,
> though. Simplified probe:
> 
> ...
> tpa6130a2_client = client;
> set_default_regs();
> acquire_power_gpio();
> acquire_regulator();
> tpa6130a2_power(1); // needs tpa6130a2_client
> check_device();
> tpa6130a2_power(0); // needs tpa6130a2_client
> ...
> 
> If tpa6130a2_add_controls() or tpa6130a2_stereo_enable() is called
> after tpa6130a2 probe has started, but before probe has completed,
> tpa6130a2_client is set, but not yet initialized. The race condition
> can be fixed easily by moving the tpa6130a2_client assignment directly
> after the regulator acquisition.
> 
> -- Sebastian

Is this race condition really relevant? If yes, then it should be fixed.

-- 
Pali Rohár
pali.rohar@...il.com