linux-kernel - Re: [PATCH v2 21/23] gpio: protect the pointer to gpio_chip in gpio

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 5 Feb 2024 14:31:48 +0200
From: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
To: Bartosz Golaszewski <brgl@...ev.pl>
Cc: Linus Walleij <linus.walleij@...aro.org>,
	Kent Gibson <warthog618@...il.com>, Alex Elder <elder@...aro.org>,
	Geert Uytterhoeven <geert+renesas@...der.be>,
	"Paul E . McKenney" <paulmck@...nel.org>,
	Wolfram Sang <wsa@...-dreams.de>, linux-gpio@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Bartosz Golaszewski <bartosz.golaszewski@...aro.org>
Subject: Re: [PATCH v2 21/23] gpio: protect the pointer to gpio_chip in
 gpio_device with SRCU

On Mon, Feb 05, 2024 at 10:34:16AM +0100, Bartosz Golaszewski wrote:
> From: Bartosz Golaszewski <bartosz.golaszewski@...aro.org>
> 
> Ensure we cannot crash if the GPIO device gets unregistered (and the
> chip pointer set to NULL) during any of the API calls.
> 
> To that end: wait for all users of gdev->chip to exit their read-only
> SRCU critical sections in gpiochip_remove().

> For brevity: add a guard class which can be instantiated at the top of
> every function requiring read-only access to the chip pointer and use it
> in all API calls taking a GPIO descriptor as argument. In places where
> we only deal with the GPIO device - use regular guard() helpers and
> rcu_dereference() for chip access. Do the same in API calls taking a
> const pointer to gpio_desc.

..

>  static ssize_t base_show(struct device *dev,
>  			       struct device_attribute *attr, char *buf)
>  {
> -	const struct gpio_device *gdev = dev_get_drvdata(dev);
> +	struct gpio_device *gdev = dev_get_drvdata(dev);
> +	struct gpio_chip *gc;
>  
> -	return sysfs_emit(buf, "%d\n", gdev->chip->base);
> +	guard(srcu)(&gdev->srcu);
> +
> +	gc = rcu_dereference(gdev->chip);
> +	if (!gc)
> +		return -ENODEV;
> +
> +	return sysfs_emit(buf, "%d\n", gc->base);

Similar Q as below.

>  }

..

>  static ssize_t label_show(struct device *dev,
>  			       struct device_attribute *attr, char *buf)
>  {
> -	const struct gpio_device *gdev = dev_get_drvdata(dev);
> +	struct gpio_device *gdev = dev_get_drvdata(dev);
> +	struct gpio_chip *gc;
>  
> -	return sysfs_emit(buf, "%s\n", gdev->chip->label ?: "");
> +	guard(srcu)(&gdev->srcu);
> +
> +	gc = rcu_dereference(gdev->chip);
> +	if (!gc)
> +		return -ENODEV;
> +
> +	return sysfs_emit(buf, "%s\n", gc->label ?: "");

Why do you need gc label here and not gdev? In other code you switched over (in
a patch before this in the series).

>  }

>  static ssize_t ngpio_show(struct device *dev,
>  			       struct device_attribute *attr, char *buf)
>  {
> -	const struct gpio_device *gdev = dev_get_drvdata(dev);
> +	struct gpio_device *gdev = dev_get_drvdata(dev);
> +	struct gpio_chip *gc;
>  
> -	return sysfs_emit(buf, "%u\n", gdev->chip->ngpio);
> +	guard(srcu)(&gdev->srcu);
> +
> +	gc = rcu_dereference(gdev->chip);
> +	if (!gc)
> +		return -ENODEV;
> +
> +	return sysfs_emit(buf, "%u\n", gc->ngpio);

Ditto.

>  }

..

>  int gpiod_get_direction(struct gpio_desc *desc)
>  {
> -	struct gpio_chip *gc;
>  	unsigned long flags;
>  	unsigned int offset;
>  	int ret;
>  
> -	gc = gpiod_to_chip(desc);
> +	if (!desc)
> +		/* Sane default is INPUT. */
> +		return 1;

Hmm... I can't imagine how this value may anyhow be used / useful.

> +	if (IS_ERR(desc))
> +		return -EINVAL;

With above said, can't we use one of VALIDATE_DESC*() macro here?

..

>  	list_for_each_entry_srcu(gdev, &gpio_devices, list,
>  				 srcu_read_lock_held(&gpio_devices_srcu)) {

> +	list_for_each_entry_srcu(gdev, &gpio_devices, list,
> +				 srcu_read_lock_held(&gpio_devices_srcu)) {

Seems like a candidate for

#define gpio_for_each_device(...) ...

..

>  	VALIDATE_DESC(desc);
>  
> -	gc = desc->gdev->chip;
> -	if (!gc->en_hw_timestamp) {
> +	CLASS(gpio_chip_guard, guard)(desc);
> +	if (!guard.gc)
> +		return -ENODEV;


Not sure if it would be good to have a respective VALIDATE_DESC_GUARDED()
or so. At least it may deduplicate a few cases.

..

> +	/* FIXME Cannot use gpio_chip_guard due to const desc. */

gpio_chip_guard()

-- 
With Best Regards,
Andy Shevchenko