linux-kernel - [PATCH v2 1/2] remoteproc: core: Remove state checking before calling rproc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 28 Mar 2022 10:20:11 +0800
From:   Shengjiu Wang <shengjiu.wang@....com>
To:     bjorn.andersson@...aro.org, mathieu.poirier@...aro.org
Cc:     linux-remoteproc@...r.kernel.org, linux-kernel@...r.kernel.org,
        shengjiu.wang@...il.com
Subject: [PATCH v2 1/2] remoteproc: core: Remove state checking before calling rproc_boot()

There is no mutex protection of the state checking before rproc_boot(),
which can't guarantee there is no another instance is trying to do
same operation.

Consider two instances case:
Instance1: echo start > /sys/class/remoteproc/remoteproc0/state
Instance2: echo start > /sys/class/remoteproc/remoteproc0/state
...
Instance2: echo stop > /sys/class/remoteproc/remoteproc0/state
...
Instance1: echo stop > /sys/class/remoteproc/remoteproc0/state

The one issue is that the instance2 case may success when 'start'
happens at same time as instance1, then rproc->power = 2; Or it
may fail with -BUSY, then rproc->power = 1; which is uncertain.

The another issue is for 'stop' operation, if the rproc->power = 1,
when instance2 'stop' the remoteproc the instance1 will be
impacted for it still needs the service at that time.

The reference counter rproc->power is used to manage state
changing and there is mutex protection in each operation
function for multi instance case.

So remove this state checking in rproc_cdev_write() and
state_store() for 'start' operation, just let reference
counter rproc->power to manage the behaviors.

Signed-off-by: Shengjiu Wang <shengjiu.wang@....com>
---
 drivers/remoteproc/remoteproc_cdev.c  | 4 ----
 drivers/remoteproc/remoteproc_sysfs.c | 4 ----
 2 files changed, 8 deletions(-)

diff --git a/drivers/remoteproc/remoteproc_cdev.c b/drivers/remoteproc/remoteproc_cdev.c
index 906ff3c4dfdd..62001eda780c 100644
--- a/drivers/remoteproc/remoteproc_cdev.c
+++ b/drivers/remoteproc/remoteproc_cdev.c
@@ -32,10 +32,6 @@ static ssize_t rproc_cdev_write(struct file *filp, const char __user *buf, size_
 		return -EFAULT;

 	if (!strncmp(cmd, "start", len)) {
-		if (rproc->state == RPROC_RUNNING ||
-		    rproc->state == RPROC_ATTACHED)
-			return -EBUSY;
-
 		ret = rproc_boot(rproc);
 	} else if (!strncmp(cmd, "stop", len)) {
 		if (rproc->state != RPROC_RUNNING &&
diff --git a/drivers/remoteproc/remoteproc_sysfs.c b/drivers/remoteproc/remoteproc_sysfs.c
index 51a04bc6ba7a..ac64d69085ab 100644
--- a/drivers/remoteproc/remoteproc_sysfs.c
+++ b/drivers/remoteproc/remoteproc_sysfs.c
@@ -194,10 +194,6 @@ static ssize_t state_store(struct device *dev,
 	int ret = 0;

 	if (sysfs_streq(buf, "start")) {
-		if (rproc->state == RPROC_RUNNING ||
-		    rproc->state == RPROC_ATTACHED)
-			return -EBUSY;
-
 		ret = rproc_boot(rproc);
 		if (ret)
 			dev_err(&rproc->dev, "Boot failed: %d\n", ret);
-- 
2.17.1