linux-kernel - Re: [PATCH v2 21/23] gpio: protect the pointer to gpio_chip in gpio

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 5 Feb 2024 14:30:51 +0100
From: Bartosz Golaszewski <brgl@...ev.pl>
To: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
Cc: Linus Walleij <linus.walleij@...aro.org>, Kent Gibson <warthog618@...il.com>, 
	Alex Elder <elder@...aro.org>, Geert Uytterhoeven <geert+renesas@...der.be>, 
	"Paul E . McKenney" <paulmck@...nel.org>, Wolfram Sang <wsa@...-dreams.de>, linux-gpio@...r.kernel.org, 
	linux-kernel@...r.kernel.org, 
	Bartosz Golaszewski <bartosz.golaszewski@...aro.org>
Subject: Re: [PATCH v2 21/23] gpio: protect the pointer to gpio_chip in
 gpio_device with SRCU

On Mon, Feb 5, 2024 at 1:31 PM Andy Shevchenko
<andriy.shevchenko@...ux.intel.com> wrote:
>
> On Mon, Feb 05, 2024 at 10:34:16AM +0100, Bartosz Golaszewski wrote:
> > From: Bartosz Golaszewski <bartosz.golaszewski@...aro.org>
> >
> > Ensure we cannot crash if the GPIO device gets unregistered (and the
> > chip pointer set to NULL) during any of the API calls.
> >
> > To that end: wait for all users of gdev->chip to exit their read-only
> > SRCU critical sections in gpiochip_remove().
>
> > For brevity: add a guard class which can be instantiated at the top of
> > every function requiring read-only access to the chip pointer and use it
> > in all API calls taking a GPIO descriptor as argument. In places where
> > we only deal with the GPIO device - use regular guard() helpers and
> > rcu_dereference() for chip access. Do the same in API calls taking a
> > const pointer to gpio_desc.
>
> ...
>
> >  static ssize_t base_show(struct device *dev,
> >                              struct device_attribute *attr, char *buf)
> >  {
> > -     const struct gpio_device *gdev = dev_get_drvdata(dev);
> > +     struct gpio_device *gdev = dev_get_drvdata(dev);
> > +     struct gpio_chip *gc;
> >
> > -     return sysfs_emit(buf, "%d\n", gdev->chip->base);
> > +     guard(srcu)(&gdev->srcu);
> > +
> > +     gc = rcu_dereference(gdev->chip);
> > +     if (!gc)
> > +             return -ENODEV;
> > +
> > +     return sysfs_emit(buf, "%d\n", gc->base);
>
> Similar Q as below.
>
> >  }
>
> ...
>
> >  static ssize_t label_show(struct device *dev,
> >                              struct device_attribute *attr, char *buf)
> >  {
> > -     const struct gpio_device *gdev = dev_get_drvdata(dev);
> > +     struct gpio_device *gdev = dev_get_drvdata(dev);
> > +     struct gpio_chip *gc;
> >
> > -     return sysfs_emit(buf, "%s\n", gdev->chip->label ?: "");
> > +     guard(srcu)(&gdev->srcu);
> > +
> > +     gc = rcu_dereference(gdev->chip);
> > +     if (!gc)
> > +             return -ENODEV;
> > +
> > +     return sysfs_emit(buf, "%s\n", gc->label ?: "");
>
> Why do you need gc label here and not gdev? In other code you switched over (in
> a patch before this in the series).
>

Yeah, good point.

> >  }
>
> >  static ssize_t ngpio_show(struct device *dev,
> >                              struct device_attribute *attr, char *buf)
> >  {
> > -     const struct gpio_device *gdev = dev_get_drvdata(dev);
> > +     struct gpio_device *gdev = dev_get_drvdata(dev);
> > +     struct gpio_chip *gc;
> >
> > -     return sysfs_emit(buf, "%u\n", gdev->chip->ngpio);
> > +     guard(srcu)(&gdev->srcu);
> > +
> > +     gc = rcu_dereference(gdev->chip);
> > +     if (!gc)
> > +             return -ENODEV;
> > +
> > +     return sysfs_emit(buf, "%u\n", gc->ngpio);
>
> Ditto.
>
> >  }
>
> ...
>
> >  int gpiod_get_direction(struct gpio_desc *desc)
> >  {
> > -     struct gpio_chip *gc;
> >       unsigned long flags;
> >       unsigned int offset;
> >       int ret;
> >
> > -     gc = gpiod_to_chip(desc);
> > +     if (!desc)
> > +             /* Sane default is INPUT. */
> > +             return 1;
>
> Hmm... I can't imagine how this value may anyhow be used / useful.
>
> > +     if (IS_ERR(desc))
> > +             return -EINVAL;
>
> With above said, can't we use one of VALIDATE_DESC*() macro here?
>

Possibly.

> ...
>
> >       list_for_each_entry_srcu(gdev, &gpio_devices, list,
> >                                srcu_read_lock_held(&gpio_devices_srcu)) {
>
> > +     list_for_each_entry_srcu(gdev, &gpio_devices, list,
> > +                              srcu_read_lock_held(&gpio_devices_srcu)) {
>
> Seems like a candidate for
>
> #define gpio_for_each_device(...) ...
>
> ...
>
> >       VALIDATE_DESC(desc);
> >
> > -     gc = desc->gdev->chip;
> > -     if (!gc->en_hw_timestamp) {
> > +     CLASS(gpio_chip_guard, guard)(desc);
> > +     if (!guard.gc)
> > +             return -ENODEV;
>
>
> Not sure if it would be good to have a respective VALIDATE_DESC_GUARDED()
> or so. At least it may deduplicate a few cases.
>

We could of course do it like this:

VALIDATE_DESC_GUARDED(desc, guard) where `guard` would be the name of
the guard variable but I generally dislike macros with flow-control
statements and I think this would just go too far. In fact: I'd gladly
get rid of VALIDATE_DESC() and co. altogether.

Bart

> ...
>
> > +     /* FIXME Cannot use gpio_chip_guard due to const desc. */
>
> gpio_chip_guard()
>
> --
> With Best Regards,
> Andy Shevchenko
>
>