| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CACMJSeu_Y2Rra8x22kWN0B38jKZEwq7=B9C75zH18QdjDHAWqg@mail.gmail.com>
Date: Wed, 15 Oct 2025 16:32:01 +0200
From: Bartosz Golaszewski <bartosz.golaszewski@...aro.org>
To: Shivendra Pratap <shivendra.pratap@....qualcomm.com>
Cc: Bjorn Andersson <andersson@...nel.org>, Sebastian Reichel <sre@...nel.org>, Rob Herring <robh@...nel.org>,
Sudeep Holla <sudeep.holla@....com>, Souvik Chakravarty <Souvik.Chakravarty@....com>,
Krzysztof Kozlowski <krzk+dt@...nel.org>, Conor Dooley <conor+dt@...nel.org>,
Andy Yan <andy.yan@...k-chips.com>, Mark Rutland <mark.rutland@....com>,
Lorenzo Pieralisi <lpieralisi@...nel.org>, Arnd Bergmann <arnd@...db.de>,
Konrad Dybcio <konradybcio@...nel.org>, cros-qcom-dts-watchers@...omium.org,
Vinod Koul <vkoul@...nel.org>, Catalin Marinas <catalin.marinas@....com>,
Will Deacon <will@...nel.org>, Florian Fainelli <florian.fainelli@...adcom.com>,
Moritz Fischer <moritz.fischer@...us.com>, John Stultz <john.stultz@...aro.org>,
Matthias Brugger <matthias.bgg@...il.com>, Krzysztof Kozlowski <krzk@...nel.org>,
Dmitry Baryshkov <dmitry.baryshkov@....qualcomm.com>,
Mukesh Ojha <mukesh.ojha@....qualcomm.com>, Stephen Boyd <swboyd@...omium.org>,
Andre Draszik <andre.draszik@...aro.org>,
Kathiravan Thirumoorthy <kathiravan.thirumoorthy@....qualcomm.com>, linux-pm@...r.kernel.org,
linux-kernel@...r.kernel.org, devicetree@...r.kernel.org,
linux-arm-kernel@...ts.infradead.org, linux-arm-msm@...r.kernel.org,
Elliot Berman <quic_eberman@...cinc.com>, Srinivas Kandagatla <srini@...nel.org>
Subject: Re: [PATCH v16 01/14] power: reset: reboot-mode: Synchronize list traversal
On Wed, 15 Oct 2025 at 06:38, Shivendra Pratap
<shivendra.pratap@....qualcomm.com> wrote:
>
> List traversals must be synchronized to prevent race conditions
> and data corruption. The reboot-mode list is not protected by a
> lock currently, which can lead to concurrent access and race.
>
> Introduce a mutex lock to guard all operations on the reboot-mode
> list and ensure thread-safe access. The change prevents unsafe
> concurrent access on reboot-mode list.
>
> Fixes: 4fcd504edbf7 ("power: reset: add reboot mode driver")
> Fixes: ca3d2ea52314 ("power: reset: reboot-mode: better compatibility with DT (replace ' ,/')")
>
> Signed-off-by: Shivendra Pratap <shivendra.pratap@....qualcomm.com>
> ---
> drivers/power/reset/reboot-mode.c | 96 +++++++++++++++++++++------------------
> include/linux/reboot-mode.h | 4 ++
> 2 files changed, 57 insertions(+), 43 deletions(-)
>
> diff --git a/drivers/power/reset/reboot-mode.c b/drivers/power/reset/reboot-mode.c
> index fba53f638da04655e756b5f8b7d2d666d1379535..8fc3e14638ea757c8dc3808c240ff569cbd74786 100644
> --- a/drivers/power/reset/reboot-mode.c
> +++ b/drivers/power/reset/reboot-mode.c
> @@ -29,9 +29,11 @@ static unsigned int get_reboot_mode_magic(struct reboot_mode_driver *reboot,
> if (!cmd)
> cmd = normal;
>
> - list_for_each_entry(info, &reboot->head, list)
> - if (!strcmp(info->mode, cmd))
> - return info->magic;
> + scoped_guard(mutex, &reboot->rb_lock) {
> + list_for_each_entry(info, &reboot->head, list)
> + if (!strcmp(info->mode, cmd))
> + return info->magic;
> + }
>
> /* try to match again, replacing characters impossible in DT */
> if (strscpy(cmd_, cmd, sizeof(cmd_)) == -E2BIG)
> @@ -41,9 +43,11 @@ static unsigned int get_reboot_mode_magic(struct reboot_mode_driver *reboot,
> strreplace(cmd_, ',', '-');
> strreplace(cmd_, '/', '-');
>
> - list_for_each_entry(info, &reboot->head, list)
> - if (!strcmp(info->mode, cmd_))
> - return info->magic;
> + scoped_guard(mutex, &reboot->rb_lock) {
> + list_for_each_entry(info, &reboot->head, list)
> + if (!strcmp(info->mode, cmd_))
> + return info->magic;
> + }
>
> return 0;
> }
> @@ -78,46 +82,50 @@ int reboot_mode_register(struct reboot_mode_driver *reboot)
>
> INIT_LIST_HEAD(&reboot->head);
>
> - for_each_property_of_node(np, prop) {
> - if (strncmp(prop->name, PREFIX, len))
> - continue;
> -
> - info = devm_kzalloc(reboot->dev, sizeof(*info), GFP_KERNEL);
> - if (!info) {
> - ret = -ENOMEM;
> - goto error;
> - }
> -
> - if (of_property_read_u32(np, prop->name, &info->magic)) {
> - dev_err(reboot->dev, "reboot mode %s without magic number\n",
> - info->mode);
> - devm_kfree(reboot->dev, info);
> - continue;
> - }
> -
> - info->mode = kstrdup_const(prop->name + len, GFP_KERNEL);
> - if (!info->mode) {
> - ret = -ENOMEM;
> - goto error;
> - } else if (info->mode[0] == '\0') {
> - kfree_const(info->mode);
> - ret = -EINVAL;
> - dev_err(reboot->dev, "invalid mode name(%s): too short!\n",
> - prop->name);
> - goto error;
> + mutex_init(&reboot->rb_lock);
> +
> + scoped_guard(mutex, &reboot->rb_lock) {
> + for_each_property_of_node(np, prop) {
> + if (strncmp(prop->name, PREFIX, len))
> + continue;
> +
> + info = devm_kzalloc(reboot->dev, sizeof(*info), GFP_KERNEL);
> + if (!info) {
> + ret = -ENOMEM;
> + goto error;
> + }
> +
> + if (of_property_read_u32(np, prop->name, &info->magic)) {
> + dev_err(reboot->dev, "reboot mode %s without magic number\n",
> + info->mode);
> + devm_kfree(reboot->dev, info);
> + continue;
> + }
> +
> + info->mode = kstrdup_const(prop->name + len, GFP_KERNEL);
> + if (!info->mode) {
> + ret = -ENOMEM;
> + goto error;
> + } else if (info->mode[0] == '\0') {
> + kfree_const(info->mode);
> + ret = -EINVAL;
> + dev_err(reboot->dev, "invalid mode name(%s): too short!\n",
> + prop->name);
> + goto error;
> + }
> +
> + list_add_tail(&info->list, &reboot->head);
This seems to be the only call that actually needs synchronization.
All of the above can be run outside the critical section.
> }
>
> - list_add_tail(&info->list, &reboot->head);
> - }
> -
> - reboot->reboot_notifier.notifier_call = reboot_mode_notify;
> - register_reboot_notifier(&reboot->reboot_notifier);
> + reboot->reboot_notifier.notifier_call = reboot_mode_notify;
> + register_reboot_notifier(&reboot->reboot_notifier);
>
> - return 0;
> + return 0;
>
> error:
> - list_for_each_entry(info, &reboot->head, list)
> - kfree_const(info->mode);
> + list_for_each_entry(info, &reboot->head, list)
> + kfree_const(info->mode);
> + }
>
> return ret;
> }
> @@ -133,8 +141,10 @@ int reboot_mode_unregister(struct reboot_mode_driver *reboot)
>
> unregister_reboot_notifier(&reboot->reboot_notifier);
>
> - list_for_each_entry(info, &reboot->head, list)
> - kfree_const(info->mode);
> + scoped_guard(mutex, &reboot->rb_lock) {
> + list_for_each_entry(info, &reboot->head, list)
> + kfree_const(info->mode);
> + }
Please destroy the mutex here.
Bart
>
> return 0;
> }
> diff --git a/include/linux/reboot-mode.h b/include/linux/reboot-mode.h
> index 4a2abb38d1d612ec0fdf05eb18c98b210f631b7f..b73f80708197677db8dc2e43affc519782b7146e 100644
> --- a/include/linux/reboot-mode.h
> +++ b/include/linux/reboot-mode.h
> @@ -2,11 +2,15 @@
> #ifndef __REBOOT_MODE_H__
> #define __REBOOT_MODE_H__
>
> +#include <linux/mutex.h>
> +
> struct reboot_mode_driver {
> struct device *dev;
> struct list_head head;
> int (*write)(struct reboot_mode_driver *reboot, unsigned int magic);
> struct notifier_block reboot_notifier;
> + /*Protects access to reboot mode list*/
> + struct mutex rb_lock;
> };
>
> int reboot_mode_register(struct reboot_mode_driver *reboot);
>
> --
> 2.34.1
>
Powered by blists - more mailing lists