linux-kernel - [PATCH] gpio: gpiolib-cdev: Fix potential &lr->wait.lock deadlock issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <TYCP286MB1188B6A0379F7928C63288DF8A21A@TYCP286MB1188.JPNP286.PROD.OUTLOOK.COM>
Date:   Sun, 25 Jun 2023 14:45:12 +0000
From:   YE Chengfeng <cyeaa@...nect.ust.hk>
To:     "linus.walleij@...aro.org" <linus.walleij@...aro.org>,
        "brgl@...ev.pl" <brgl@...ev.pl>,
        "andy@...nel.org" <andy@...nel.org>
CC:     "linux-gpio@...r.kernel.org" <linux-gpio@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: [PATCH] gpio: gpiolib-cdev: Fix potential &lr->wait.lock deadlock
 issue

linereq_put_event is called from both interrupt context (e.g.,
edge_irq_thread) and process context (process_hw_ts_thread).
Therefore, interrupt should be disabled before acquiring lock
&lr->wait.lock inside linereq_put_event to avoid deadlock when
the lock is held in process context and edge_irq_thread comes.

Similarly, linereq_read_unlocked running in process context
also acquies the same lock. It also need to disable interrupt
otherwise deadlock could happen if the irq edge_irq_thread
comes to execution while the lock is held.

Fix the two potential deadlock issues by spin_lock_irqsave.

Signed-off-by: Chengfeng Ye <cyeaa@...nect.ust.hk>
---
 drivers/gpio/gpiolib-cdev.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c
index 0a33971c964c..714631fde9a8 100644
--- a/drivers/gpio/gpiolib-cdev.c
+++ b/drivers/gpio/gpiolib-cdev.c
@@ -614,14 +614,15 @@ static void linereq_put_event(struct linereq *lr,
 			      struct gpio_v2_line_event *le)
 {
 	bool overflow = false;
+	unsigned long flags;
 
-	spin_lock(&lr->wait.lock);
+	spin_lock_irqsave(&lr->wait.lock, flags);
 	if (kfifo_is_full(&lr->events)) {
 		overflow = true;
 		kfifo_skip(&lr->events);
 	}
 	kfifo_in(&lr->events, le, 1);
-	spin_unlock(&lr->wait.lock);
+	spin_unlock_irqrestore(&lr->wait.lock, flags);
 	if (!overflow)
 		wake_up_poll(&lr->wait, EPOLLIN);
 	else
@@ -1505,6 +1506,7 @@ static ssize_t linereq_read_unlocked(struct file *file, char __user *buf,
 	struct linereq *lr = file->private_data;
 	struct gpio_v2_line_event le;
 	ssize_t bytes_read = 0;
+	unsigned long flags;
 	int ret;
 
 	if (!lr->gdev->chip)
@@ -1514,28 +1516,28 @@ static ssize_t linereq_read_unlocked(struct file *file, char __user *buf,
 		return -EINVAL;
 
 	do {
-		spin_lock(&lr->wait.lock);
+		spin_lock_irqsave(&lr->wait.lock, flags);
 		if (kfifo_is_empty(&lr->events)) {
 			if (bytes_read) {
-				spin_unlock(&lr->wait.lock);
+				spin_unlock_irqrestore(&lr->wait.lock, flags);
 				return bytes_read;
 			}
 
 			if (file->f_flags & O_NONBLOCK) {
-				spin_unlock(&lr->wait.lock);
+				spin_unlock_irqrestore(&lr->wait.lock, flags);
 				return -EAGAIN;
 			}
 
 			ret = wait_event_interruptible_locked(lr->wait,
 					!kfifo_is_empty(&lr->events));
 			if (ret) {
-				spin_unlock(&lr->wait.lock);
+				spin_unlock_irqrestore(&lr->wait.lock, flags);
 				return ret;
 			}
 		}
 
 		ret = kfifo_out(&lr->events, &le, 1);
-		spin_unlock(&lr->wait.lock);
+		spin_unlock_irqrestore(&lr->wait.lock, flags);
 		if (ret != 1) {
 			/*
 			 * This should never happen - we were holding the
-- 
2.17.1