linux-kernel - [PATCH] drivers: char: applicom.c: Add lock for protecting DeviceErrorCount

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon,  3 Aug 2020 16:20:49 +0530
From:   madhuparnabhowmik10@...il.com
To:     arnd@...db.de, gregkh@...uxfoundation.org
Cc:     linux-kernel@...r.kernel.org, andrianov@...ras.ru,
        ldv-project@...uxtesting.org,
        Madhuparna Bhowmik <madhuparnabhowmik10@...il.com>
Subject: [PATCH] drivers: char: applicom.c: Add lock for protecting DeviceErrorCount

From: Madhuparna Bhowmik <madhuparnabhowmik10@...il.com>

The variable DeviceErrorCount is used to keep track of the number of
errors in read, write and interrupt routines, however it was not
protected by proper locking.
Therefore, this patch adds a spinlock: error_lock to protect the
variable.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Madhuparna Bhowmik <madhuparnabhowmik10@...il.com>
---
 drivers/char/applicom.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c
index 14b2d8034c51..6df7450b8b99 100644
--- a/drivers/char/applicom.c
+++ b/drivers/char/applicom.c
@@ -106,6 +106,7 @@ static DECLARE_WAIT_QUEUE_HEAD(FlagSleepRec);
 static unsigned int WriteErrorCount;	/* number of write error      */
 static unsigned int ReadErrorCount;	/* number of read error       */
 static unsigned int DeviceErrorCount;	/* number of device error     */
+DEFINE_SPINLOCK(error_lock);		/* lock to protect error count variables */
 
 static ssize_t ac_read (struct file *, char __user *, size_t, loff_t *);
 static ssize_t ac_write (struct file *, const char __user *, size_t, loff_t *);
@@ -428,7 +429,9 @@ static ssize_t ac_write(struct file *file, const char __user *buf, size_t count,
 		spin_unlock_irqrestore(&apbs[IndexCard].mutex, flags);
 		printk(KERN_WARNING "APPLICOM driver write error board %d, DataFromPcReady = %d\n",
 		       IndexCard,(int)readb(apbs[IndexCard].RamIO + DATA_FROM_PC_READY));
+		spin_lock_irqsave(&error_lock, flags);
 		DeviceErrorCount++;
+		spin_unlock_irqrestore(&error_lock, flags);
 		return -EIO;
 	}
 	
@@ -593,7 +596,9 @@ static ssize_t ac_read (struct file *filp, char __user *buf, size_t count, loff_
 				
 				printk(KERN_WARNING "APPLICOM driver read error board %d, DataToPcReady = %d\n",
 				       i,(int)readb(apbs[i].RamIO + DATA_TO_PC_READY));
+				spin_lock_irqsave(&error_lock, flags);
 				DeviceErrorCount++;
+				spin_unlock_irqrestore(&error_lock, flags);
 				return -EIO;
 			}
 			
@@ -653,7 +658,9 @@ static irqreturn_t ac_interrupt(int vec, void *dev_instance)
 			if (readb(apbs[i].RamIO + DATA_TO_PC_READY) > 2) {
 				printk(KERN_WARNING "APPLICOM driver interrupt err board %d, DataToPcReady = %d\n",
 				       i+1,(int)readb(apbs[i].RamIO + DATA_TO_PC_READY));
+				spin_lock(&error_lock);
 				DeviceErrorCount++;
+				spin_unlock(&error_lock);
 			}
 
 			if((readb(apbs[i].RamIO + DATA_FROM_PC_READY) > 2) && 
@@ -661,7 +668,9 @@ static irqreturn_t ac_interrupt(int vec, void *dev_instance)
 				
 				printk(KERN_WARNING "APPLICOM driver interrupt err board %d, DataFromPcReady = %d\n",
 				       i+1,(int)readb(apbs[i].RamIO + DATA_FROM_PC_READY));
+				spin_lock(&error_lock);
 				DeviceErrorCount++;
+				spin_unlock(&error_lock);
 			}
 
 			if (readb(apbs[i].RamIO + DATA_TO_PC_READY) == 2) {	/* mailbox sent by the card ?   */
@@ -699,6 +708,7 @@ static long ac_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
      
 {				/* @ ADG ou ATO selon le cas */
 	int i;
+	unsigned long flags;
 	unsigned char IndexCard;
 	void __iomem *pmem;
 	int ret = 0;
@@ -819,12 +829,14 @@ static long ac_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 			else
 				printk("\n");
 		}
+		spin_lock_irqsave(&error_lock, flags);
 		if (DeviceErrorCount != 0)
 			printk(KERN_INFO "DeviceErrorCount ........... %d\n", DeviceErrorCount);
 		if (ReadErrorCount != 0)
 			printk(KERN_INFO "ReadErrorCount ............. %d\n", ReadErrorCount);
 		if (WriteErrorCount != 0)
 			printk(KERN_INFO "WriteErrorCount ............ %d\n", WriteErrorCount);
+		spin_unlock_irqrestore(&error_lock, flags);
 		if (waitqueue_active(&FlagSleepRec))
 			printk(KERN_INFO "Process in read pending\n");
 		for (i = 0; i < MAX_BOARD; i++) {
-- 
2.17.1