linux-kernel - Re: [PATCH 07/14] iio: triggers: on pollfunc attach, complete iio

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20171229172337.6226de69@archlinux>
Date:   Fri, 29 Dec 2017 17:23:37 +0000
From:   Jonathan Cameron <jic23@...nel.org>
To:     Eugen Hristev <eugen.hristev@...rochip.com>
Cc:     <nicolas.ferre@...rochip.com>, <ludovic.desroches@...rochip.com>,
        <alexandre.belloni@...e-electrons.com>,
        <linux-iio@...r.kernel.org>,
        <linux-arm-kernel@...ts.infradead.org>,
        <devicetree@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <linux-input@...r.kernel.org>, <dmitry.torokhov@...il.com>
Subject: Re: [PATCH 07/14] iio: triggers: on pollfunc attach, complete
 iio_dev if NULL

On Fri, 22 Dec 2017 17:07:14 +0200
Eugen Hristev <eugen.hristev@...rochip.com> wrote:

> When attaching a pollfunc to a trigger, if the pollfunc does not
> have an associated iio_dev pointer, just use the private data
> iio_dev pointer from the trigger to fill in the poll func required
> iio_dev reference.
> 
> Signed-off-by: Eugen Hristev <eugen.hristev@...rochip.com>

I'm yet to be convinced this is necessary rather than using a callback
buffer. It's also decidedly unsafe as there is no particular reason
in general to assume the private data is an iio_dev.

> ---
>  drivers/iio/industrialio-trigger.c   | 9 +++++++++
>  include/linux/iio/trigger_consumer.h | 2 ++
>  2 files changed, 11 insertions(+)
> 
> diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c
> index 8565c92..ab180bd 100644
> --- a/drivers/iio/industrialio-trigger.c
> +++ b/drivers/iio/industrialio-trigger.c
> @@ -272,6 +272,15 @@ int iio_trigger_attach_poll_func(struct iio_trigger *trig,
>  	bool notinuse
>  		= bitmap_empty(trig->pool, CONFIG_IIO_CONSUMERS_PER_TRIGGER);
>  
> +	/*
> +	 * If we did not get a iio_dev in the poll func, attempt to
> +	 * obtain the trigger's owner's device struct
> +	 */
> +	if (!pf->indio_dev)
> +		pf->indio_dev = iio_trigger_get_drvdata(trig);

That isn't always valid. Triggers don't always have a iio_dev associated
with them at all.
> +	if (!pf->indio_dev)
> +		return -EINVAL;
> +
>  	/* Prevent the module from being removed whilst attached to a trigger */
>  	__module_get(pf->indio_dev->driver_module);
>  
> diff --git a/include/linux/iio/trigger_consumer.h b/include/linux/iio/trigger_consumer.h
> index aeefcdb..36e2a02 100644
> --- a/include/linux/iio/trigger_consumer.h
> +++ b/include/linux/iio/trigger_consumer.h
> @@ -63,6 +63,8 @@ int iio_triggered_buffer_predisable(struct iio_dev *indio_dev);
>  /*
>   * Two functions for the uncommon case when we need to attach or detach
>   * a specific pollfunc to and from a trigger
> + * If the pollfunc has a NULL iio_dev pointer, it will be filled from the
> + * trigger struct.
>   */
>  int iio_trigger_attach_poll_func(struct iio_trigger *trig,
>  				 struct iio_poll_func *pf);