linux-kernel - Re: [PATCH RESEND v2 3/5] extcon: extcon-max77693.c: Fix potential work-queue cancellation race

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 11 Jun 2021 18:04:48 +0900
From:   Chanwoo Choi <cw00.choi@...sung.com>
To:     Hans de Goede <hdegoede@...hat.com>,
        Matti Vaittinen <matti.vaittinen@...rohmeurope.com>,
        Matti Vaittinen <mazziesaccount@...il.com>
Cc:     Krzysztof Kozlowski <krzysztof.kozlowski@...onical.com>,
        Bartlomiej Zolnierkiewicz <b.zolnierkie@...sung.com>,
        MyungJoo Ham <myungjoo.ham@...sung.com>,
        Marek Szyprowski <m.szyprowski@...sung.com>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH RESEND v2 3/5] extcon: extcon-max77693.c: Fix potential
 work-queue cancellation race

On 6/10/21 6:49 PM, Hans de Goede wrote:
> Hi,
> 
> On 6/10/21 11:43 AM, Chanwoo Choi wrote:
>> On 6/8/21 7:10 PM, Matti Vaittinen wrote:
>>> The extcon IRQ schedules a work item. IRQ is requested using devm while
>>> WQ is cancelld at remove(). This mixing of devm and manual unwinding has
>>> potential case where the WQ has been emptied (.remove() was ran) but
>>> devm unwinding of IRQ was not yet done. It may be possible the IRQ is
>>> triggered at this point scheduling new work item to the already flushed
>>> queue.
>>>
>>> According to the input documentation the input device allocated by
>>> devm_input_allocate_device() does not need to be explicitly unregistered.
>>> Use the new devm_work_autocancel() and remove the remove() to simplify the
>>> code.
>>>
>>> Signed-off-by: Matti Vaittinen <matti.vaittinen@...rohmeurope.com>
>>> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@...onical.com>
>>> Reviewed-by: Hans de Goede <hdegoede@...hat.com>
>>> ---
>>>
>>> Please note that the change is compile-tested only. All proper testing is
>>> highly appreciated.
>>> ---
>>>  drivers/extcon/extcon-max77693.c | 17 +++++------------
>>>  1 file changed, 5 insertions(+), 12 deletions(-)
>>>
>>> diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c
>>> index 92af97e00828..1f1d9ab0c5c7 100644
>>> --- a/drivers/extcon/extcon-max77693.c
>>> +++ b/drivers/extcon/extcon-max77693.c
>>> @@ -5,6 +5,7 @@
>>>  // Copyright (C) 2012 Samsung Electrnoics
>>>  // Chanwoo Choi <cw00.choi@...sung.com>
>>>  
>>> +#include <linux/devm-helpers.h>
>>>  #include <linux/kernel.h>
>>>  #include <linux/module.h>
>>>  #include <linux/i2c.h>
>>> @@ -1127,7 +1128,10 @@ static int max77693_muic_probe(struct platform_device *pdev)
>>>  	platform_set_drvdata(pdev, info);
>>>  	mutex_init(&info->mutex);
>>>  
>>> -	INIT_WORK(&info->irq_work, max77693_muic_irq_work);
>>> +	ret = devm_work_autocancel(&pdev->dev, &info->irq_work,
>>> +				   max77693_muic_irq_work);
>>> +	if (ret)
>>> +		return ret;
>>>  
>>>  	/* Support irq domain for MAX77693 MUIC device */
>>>  	for (i = 0; i < ARRAY_SIZE(muic_irqs); i++) {
>>> @@ -1254,22 +1258,11 @@ static int max77693_muic_probe(struct platform_device *pdev)
>>>  	return ret;
>>>  }
>>>  
>>> -static int max77693_muic_remove(struct platform_device *pdev)
>>> -{
>>> -	struct max77693_muic_info *info = platform_get_drvdata(pdev);
>>> -
>>> -	cancel_work_sync(&info->irq_work);
>>> -	input_unregister_device(info->dock);
>>
>> I think that you have to keep the input_unregister_device().
> 
> As mentioned in the commit message, in input_unregister_device
> is not necessary for input-devices created with
> devm_input_allocate_device():
> 
> "According to the input documentation the input device allocated by
> devm_input_allocate_device() does not need to be explicitly unregistered."
> 
> I have verified that the documentation is correct here, so there is
> no need to keep the input_unregister_device() as it was never necessary
> to have that there.

You're right. I got it from Matti Vaittinen review.
I replied the ack message.

-- 
Best Regards,
Chanwoo Choi
Samsung Electronics