linux-kernel - Re: [PATCH v2 11/16] iio: adc: max1027: Prevent single channel accesses during buffer reads

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 5 Sep 2021 16:38:04 +0100
From:   Jonathan Cameron <jic23@...nel.org>
To:     Miquel Raynal <miquel.raynal@...tlin.com>
Cc:     Lars-Peter Clausen <lars@...afoo.de>, linux-iio@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        Thomas Petazzoni <thomas.petazzoni@...tlin.com>,
        Nuno Sa <Nuno.Sa@...log.com>
Subject: Re: [PATCH v2 11/16] iio: adc: max1027: Prevent single channel
 accesses during buffer reads

On Thu,  2 Sep 2021 23:14:32 +0200
Miquel Raynal <miquel.raynal@...tlin.com> wrote:

> When hardware buffers are enabled (the cnvst pin being the trigger), one
> should not mess with the device state by requesting a single channel
> read.
> 
> There is already a iio_buffer_enabled() check in *_read_single_value()
> to merely prevent this situation but the check is inconsistent since
> buffers can be enabled after the if clause anyway. Instead, use the core
> mutex by calling iio_device_claim/release_direct_mode().
> 
> Signed-off-by: Miquel Raynal <miquel.raynal@...tlin.com>
> ---
>  drivers/iio/adc/max1027.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/iio/adc/max1027.c b/drivers/iio/adc/max1027.c
> index f4cb5c75604b..57f62ea2d7aa 100644
> --- a/drivers/iio/adc/max1027.c
> +++ b/drivers/iio/adc/max1027.c
> @@ -296,10 +296,9 @@ static int max1027_read_single_value(struct iio_dev *indio_dev,
>  	int ret;
>  	struct max1027_state *st = iio_priv(indio_dev);
>  
> -	if (iio_buffer_enabled(indio_dev)) {
> -		dev_warn(&indio_dev->dev, "trigger mode already enabled");
> -		return -EBUSY;
> -	}
> +	ret = iio_device_claim_direct_mode(indio_dev);
> +	if (ret)
> +		return ret;

>  
>  	/* Configure conversion register with the requested chan */
>  	st->reg = MAX1027_CONV_REG | MAX1027_CHAN(chan->channel) |
> @@ -325,6 +324,8 @@ static int max1027_read_single_value(struct iio_dev *indio_dev,
>  	if (ret < 0)
>  		return ret;

Must also be released in error paths.  Treat it like a lock (there is one
internally) so to avoid permanent deadlock we must release it even if things
are going wrong

>  
> +	iio_device_release_direct_mode(indio_dev);
> +
>  	*val = be16_to_cpu(st->buffer[0]);
>  
>  	return IIO_VAL_INT;