linux-kernel - [RFC] iio: Release irq if set_trigger

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 28 Apr 2016 19:40:22 +0300
From:	Crestez Dan Leonard <leonard.crestez@...el.com>
To:	Jonathan Cameron <jic23@...nel.org>, linux-iio@...r.kernel.org
Cc:	linux-kernel@...r.kernel.org, Hartmut Knaack <knaack.h@....de>,
	Lars-Peter Clausen <lars@...afoo.de>,
	Peter Meerwald-Stadler <pmeerw@...erw.net>,
	Daniel Baluta <daniel.baluta@...el.com>,
	Crestez Dan Leonard <leonard.crestez@...el.com>
Subject: [RFC] iio: Release irq if set_trigger_state fails

When attaching a pollfunc iio_trigger_attach_poll_func will allocate a
virtual irq and call the driver's set_trigger_state function. Fix error
handling to release the irq if set_trigger_state fails.

Otherwise when using triggered buffers and the driver's
set_trigger_state fails once then the buffer becomes unusable.

It is not possible to handle this sort of error by calling
iio_trigger_detach_poll_func externally somehow. That function should
only be called if attach is successful.

Signed-off-by: Crestez Dan Leonard <leonard.crestez@...el.com>
---

I ran into this while adding some validation in driver's set_trigger_state
function. It's much better to use buffer_ops->predisable for that kind of stuff
but the iio core should still handle set_trigger_state errors correctly.

 drivers/iio/industrialio-trigger.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c
index ae2806a..cf2be3e 100644
--- a/drivers/iio/industrialio-trigger.c
+++ b/drivers/iio/industrialio-trigger.c
@@ -214,18 +214,23 @@ static int iio_trigger_attach_poll_func(struct iio_trigger *trig,
 	ret = request_threaded_irq(pf->irq, pf->h, pf->thread,
 				   pf->type, pf->name,
 				   pf);
-	if (ret < 0) {
-		module_put(pf->indio_dev->info->driver_module);
-		return ret;
-	}
+	if (ret < 0)
+		goto out_put_module;

 	if (trig->ops && trig->ops->set_trigger_state && notinuse) {
 		ret = trig->ops->set_trigger_state(trig, true);
 		if (ret < 0)
-			module_put(pf->indio_dev->info->driver_module);
+			goto out_put_irq;
 	}

 	return ret;
+
+out_put_irq:
+	iio_trigger_put_irq(trig, pf->irq);
+	free_irq(pf->irq, pf);
+out_put_module:
+	module_put(pf->indio_dev->info->driver_module);
+	return ret;
 }

 static int iio_trigger_detach_poll_func(struct iio_trigger *trig,
-- 
2.5.5