linux-kernel - [PATCH v2 2/2] gpiolib: cdev: Fix &le->wait.lock deadlock issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <TYCP286MB1188DCADAAC7318EEC06293E8A26A@TYCP286MB1188.JPNP286.PROD.OUTLOOK.COM>
Date:   Mon, 26 Jun 2023 10:40:01 +0000
From:   YE Chengfeng <cyeaa@...nect.ust.hk>
To:     Linus Walleij <linus.walleij@...aro.org>,
        Bartosz Golaszewski <brgl@...ev.pl>,
        "andy@...nel.org" <andy@...nel.org>
CC:     "linux-gpio@...r.kernel.org" <linux-gpio@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: [PATCH v2 2/2] gpiolib: cdev: Fix &le->wait.lock deadlock issue

The softirq lineevent_irq_thread() could deadlock on &le->wait.lock
if it preempts lineevent_read_unlocked() which acquires the same
lock but not disable irq.

Fix the potential deadlock by spin_lock_irq().

Fixes: dea9c80ee672 ("gpiolib: rework the locking mechanism for lineevent kfifo")
Signed-off-by: Chengfeng Ye <cyeaa@...nect.ust.hk>
---
 drivers/gpio/gpiolib-cdev.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c
index f768d46bdea7..a2c108f172f2 100644
--- a/drivers/gpio/gpiolib-cdev.c
+++ b/drivers/gpio/gpiolib-cdev.c
@@ -1858,28 +1858,28 @@ static ssize_t lineevent_read_unlocked(struct file *file, char __user *buf,
 		return -EINVAL;
 
 	do {
-		spin_lock(&le->wait.lock);
+		spin_lock_irq(&le->wait.lock);
 		if (kfifo_is_empty(&le->events)) {
 			if (bytes_read) {
-				spin_unlock(&le->wait.lock);
+				spin_unlock_irq(&le->wait.lock);
 				return bytes_read;
 			}
 
 			if (file->f_flags & O_NONBLOCK) {
-				spin_unlock(&le->wait.lock);
+				spin_unlock_irq(&le->wait.lock);
 				return -EAGAIN;
 			}
 
-			ret = wait_event_interruptible_locked(le->wait,
+			ret = wait_event_interruptible_locked_irq(le->wait,
 					!kfifo_is_empty(&le->events));
 			if (ret) {
-				spin_unlock(&le->wait.lock);
+				spin_unlock_irq(&le->wait.lock);
 				return ret;
 			}
 		}
 
 		ret = kfifo_out(&le->events, &ge, 1);
-		spin_unlock(&le->wait.lock);
+		spin_unlock_irq(&le->wait.lock);
 		if (ret != 1) {
 			/*
 			 * This should never happen - we were holding the lock
-- 
2.17.1