linux-kernel - Re: [PATCH] counter: interrupt-cnt: Protect enable/disable OPs with mutex

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <059003d1-d725-4439-a6d7-cb354fba161b@pengutronix.de>
Date: Tue, 1 Apr 2025 06:50:33 +0200
From: Ahmad Fatoum <a.fatoum@...gutronix.de>
To: "A. Sverdlin" <alexander.sverdlin@...mens.com>, linux-iio@...r.kernel.org
Cc: Oleksij Rempel <o.rempel@...gutronix.de>, linux-kernel@...r.kernel.org,
 Pengutronix Kernel Team <kernel@...gutronix.de>,
 William Breathitt Gray <wbg@...nel.org>
Subject: Re: [PATCH] counter: interrupt-cnt: Protect enable/disable OPs with
 mutex

Hello Alexander,

On 31.03.25 18:36, A. Sverdlin wrote:
> From: Alexander Sverdlin <alexander.sverdlin@...mens.com>
> 
> Enable/disable seems to be racy on SMP, consider the following scenario:
> 
> CPU0					CPU1
> 
> interrupt_cnt_enable_write(true)
> {
> 	if (priv->enabled == enable)
> 		return 0;
> 
> 	if (enable) {
> 		priv->enabled = true;
> 					interrupt_cnt_enable_write(false)
> 					{
> 						if (priv->enabled == enable)
> 							return 0;
> 
> 						if (enable) {
> 							priv->enabled = true;
> 							enable_irq(priv->irq);
> 						} else {
> 							disable_irq(priv->irq)
> 							priv->enabled = false;
> 						}
> 		enable_irq(priv->irq);
> 	} else {
> 		disable_irq(priv->irq);
> 		priv->enabled = false;
> 	}
> 
> The above would result in priv->enabled == false, but IRQ left enabled.
> Protect both write (above race) and read (to propagate the value on SMP)
> callbacks with a mutex.

Doesn't sysfs/kernfs already ensure that the ops may not be called concurrently
on the same open file?

Thanks,
Ahmad

> 
> Signed-off-by: Alexander Sverdlin <alexander.sverdlin@...mens.com>
> ---
>  drivers/counter/interrupt-cnt.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/drivers/counter/interrupt-cnt.c b/drivers/counter/interrupt-cnt.c
> index 949598d51575a..d83848d0fe2af 100644
> --- a/drivers/counter/interrupt-cnt.c
> +++ b/drivers/counter/interrupt-cnt.c
> @@ -3,12 +3,14 @@
>   * Copyright (c) 2021 Pengutronix, Oleksij Rempel <kernel@...gutronix.de>
>   */
>  
> +#include <linux/cleanup.h>
>  #include <linux/counter.h>
>  #include <linux/gpio/consumer.h>
>  #include <linux/interrupt.h>
>  #include <linux/irq.h>
>  #include <linux/mod_devicetable.h>
>  #include <linux/module.h>
> +#include <linux/mutex.h>
>  #include <linux/platform_device.h>
>  #include <linux/types.h>
>  
> @@ -19,6 +21,7 @@ struct interrupt_cnt_priv {
>  	struct gpio_desc *gpio;
>  	int irq;
>  	bool enabled;
> +	struct mutex lock;
>  	struct counter_signal signals;
>  	struct counter_synapse synapses;
>  	struct counter_count cnts;
> @@ -41,6 +44,8 @@ static int interrupt_cnt_enable_read(struct counter_device *counter,
>  {
>  	struct interrupt_cnt_priv *priv = counter_priv(counter);
>  
> +	guard(mutex)(&priv->lock);
> +
>  	*enable = priv->enabled;
>  
>  	return 0;
> @@ -51,6 +56,8 @@ static int interrupt_cnt_enable_write(struct counter_device *counter,
>  {
>  	struct interrupt_cnt_priv *priv = counter_priv(counter);
>  
> +	guard(mutex)(&priv->lock);
> +
>  	if (priv->enabled == enable)
>  		return 0;
>  
> @@ -227,6 +234,8 @@ static int interrupt_cnt_probe(struct platform_device *pdev)
>  	if (ret)
>  		return ret;
>  
> +	mutex_init(&priv->lock);
> +
>  	ret = devm_counter_add(dev, counter);
>  	if (ret < 0)
>  		return dev_err_probe(dev, ret, "Failed to add counter\n");


-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |