| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2c8e7d94-cacb-427f-02ec-ecc83a189479@oss.qualcomm.com>
Date: Fri, 17 Oct 2025 20:17:33 +0530
From: Shivendra Pratap <shivendra.pratap@....qualcomm.com>
To: Bartosz Golaszewski <bartosz.golaszewski@...aro.org>
Cc: Bjorn Andersson <andersson@...nel.org>,
Sebastian Reichel
<sre@...nel.org>, Rob Herring <robh@...nel.org>,
Sudeep Holla <sudeep.holla@....com>,
Souvik Chakravarty <Souvik.Chakravarty@....com>,
Krzysztof Kozlowski <krzk+dt@...nel.org>,
Conor Dooley
<conor+dt@...nel.org>,
Andy Yan <andy.yan@...k-chips.com>,
Mark Rutland <mark.rutland@....com>,
Lorenzo Pieralisi <lpieralisi@...nel.org>,
Arnd Bergmann <arnd@...db.de>, Konrad Dybcio <konradybcio@...nel.org>,
cros-qcom-dts-watchers@...omium.org, Vinod Koul <vkoul@...nel.org>,
Catalin Marinas <catalin.marinas@....com>,
Will Deacon <will@...nel.org>,
Florian Fainelli <florian.fainelli@...adcom.com>,
Moritz Fischer <moritz.fischer@...us.com>,
John Stultz <john.stultz@...aro.org>,
Matthias Brugger <matthias.bgg@...il.com>,
Krzysztof Kozlowski <krzk@...nel.org>,
Dmitry Baryshkov <dmitry.baryshkov@....qualcomm.com>,
Mukesh Ojha <mukesh.ojha@....qualcomm.com>,
Stephen Boyd <swboyd@...omium.org>,
Andre Draszik
<andre.draszik@...aro.org>,
Kathiravan Thirumoorthy <kathiravan.thirumoorthy@....qualcomm.com>,
linux-pm@...r.kernel.org, linux-kernel@...r.kernel.org,
devicetree@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
linux-arm-msm@...r.kernel.org,
Elliot Berman <quic_eberman@...cinc.com>,
Srinivas Kandagatla <srini@...nel.org>
Subject: Re: [PATCH v16 01/14] power: reset: reboot-mode: Synchronize list
traversal
On 10/15/2025 8:02 PM, Bartosz Golaszewski wrote:
> On Wed, 15 Oct 2025 at 06:38, Shivendra Pratap
> <shivendra.pratap@....qualcomm.com> wrote:
>>
>> List traversals must be synchronized to prevent race conditions
>> and data corruption. The reboot-mode list is not protected by a
>> lock currently, which can lead to concurrent access and race.
>>
>> Introduce a mutex lock to guard all operations on the reboot-mode
>> list and ensure thread-safe access. The change prevents unsafe
>> concurrent access on reboot-mode list.
>>
>> Fixes: 4fcd504edbf7 ("power: reset: add reboot mode driver")
>> Fixes: ca3d2ea52314 ("power: reset: reboot-mode: better compatibility with DT (replace ' ,/')")
>>
>> Signed-off-by: Shivendra Pratap <shivendra.pratap@....qualcomm.com>
>> ---
>> drivers/power/reset/reboot-mode.c | 96 +++++++++++++++++++++------------------
>> include/linux/reboot-mode.h | 4 ++
>> 2 files changed, 57 insertions(+), 43 deletions(-)
>>
>> diff --git a/drivers/power/reset/reboot-mode.c b/drivers/power/reset/reboot-mode.c
>> index fba53f638da04655e756b5f8b7d2d666d1379535..8fc3e14638ea757c8dc3808c240ff569cbd74786 100644
>> --- a/drivers/power/reset/reboot-mode.c
>> +++ b/drivers/power/reset/reboot-mode.c
>> @@ -29,9 +29,11 @@ static unsigned int get_reboot_mode_magic(struct reboot_mode_driver *reboot,
>> if (!cmd)
>> cmd = normal;
>>
>> - list_for_each_entry(info, &reboot->head, list)
>> - if (!strcmp(info->mode, cmd))
>> - return info->magic;
>> + scoped_guard(mutex, &reboot->rb_lock) {
>> + list_for_each_entry(info, &reboot->head, list)
>> + if (!strcmp(info->mode, cmd))
>> + return info->magic;
>> + }
>>
>> /* try to match again, replacing characters impossible in DT */
>> if (strscpy(cmd_, cmd, sizeof(cmd_)) == -E2BIG)
>> @@ -41,9 +43,11 @@ static unsigned int get_reboot_mode_magic(struct reboot_mode_driver *reboot,
>> strreplace(cmd_, ',', '-');
>> strreplace(cmd_, '/', '-');
>>
>> - list_for_each_entry(info, &reboot->head, list)
>> - if (!strcmp(info->mode, cmd_))
>> - return info->magic;
>> + scoped_guard(mutex, &reboot->rb_lock) {
>> + list_for_each_entry(info, &reboot->head, list)
>> + if (!strcmp(info->mode, cmd_))
>> + return info->magic;
>> + }
>>
>> return 0;
>> }
>> @@ -78,46 +82,50 @@ int reboot_mode_register(struct reboot_mode_driver *reboot)
>>
>> INIT_LIST_HEAD(&reboot->head);
>>
>> - for_each_property_of_node(np, prop) {
>> - if (strncmp(prop->name, PREFIX, len))
>> - continue;
>> -
>> - info = devm_kzalloc(reboot->dev, sizeof(*info), GFP_KERNEL);
>> - if (!info) {
>> - ret = -ENOMEM;
>> - goto error;
>> - }
>> -
>> - if (of_property_read_u32(np, prop->name, &info->magic)) {
>> - dev_err(reboot->dev, "reboot mode %s without magic number\n",
>> - info->mode);
>> - devm_kfree(reboot->dev, info);
>> - continue;
>> - }
>> -
>> - info->mode = kstrdup_const(prop->name + len, GFP_KERNEL);
>> - if (!info->mode) {
>> - ret = -ENOMEM;
>> - goto error;
>> - } else if (info->mode[0] == '\0') {
>> - kfree_const(info->mode);
>> - ret = -EINVAL;
>> - dev_err(reboot->dev, "invalid mode name(%s): too short!\n",
>> - prop->name);
>> - goto error;
>> + mutex_init(&reboot->rb_lock);
>> +
>> + scoped_guard(mutex, &reboot->rb_lock) {
>> + for_each_property_of_node(np, prop) {
>> + if (strncmp(prop->name, PREFIX, len))
>> + continue;
>> +
>> + info = devm_kzalloc(reboot->dev, sizeof(*info), GFP_KERNEL);
>> + if (!info) {
>> + ret = -ENOMEM;
>> + goto error;
>> + }
>> +
>> + if (of_property_read_u32(np, prop->name, &info->magic)) {
>> + dev_err(reboot->dev, "reboot mode %s without magic number\n",
>> + info->mode);
>> + devm_kfree(reboot->dev, info);
>> + continue;
>> + }
>> +
>> + info->mode = kstrdup_const(prop->name + len, GFP_KERNEL);
>> + if (!info->mode) {
>> + ret = -ENOMEM;
>> + goto error;
>> + } else if (info->mode[0] == '\0') {
>> + kfree_const(info->mode);
>> + ret = -EINVAL;
>> + dev_err(reboot->dev, "invalid mode name(%s): too short!\n",
>> + prop->name);
>> + goto error;
>> + }
>> +
>> + list_add_tail(&info->list, &reboot->head);
>
> This seems to be the only call that actually needs synchronization.
> All of the above can be run outside the critical section.
sure. will add it only around the required lines.
>
>> }
>>
>> - list_add_tail(&info->list, &reboot->head);
>> - }
>> -
>> - reboot->reboot_notifier.notifier_call = reboot_mode_notify;
>> - register_reboot_notifier(&reboot->reboot_notifier);
>> + reboot->reboot_notifier.notifier_call = reboot_mode_notify;
>> + register_reboot_notifier(&reboot->reboot_notifier);
>>
>> - return 0;
>> + return 0;
>>
>> error:
>> - list_for_each_entry(info, &reboot->head, list)
>> - kfree_const(info->mode);
>> + list_for_each_entry(info, &reboot->head, list)
>> + kfree_const(info->mode);
>> + }
>>
>> return ret;
>> }
>> @@ -133,8 +141,10 @@ int reboot_mode_unregister(struct reboot_mode_driver *reboot)
>>
>> unregister_reboot_notifier(&reboot->reboot_notifier);
>>
>> - list_for_each_entry(info, &reboot->head, list)
>> - kfree_const(info->mode);
>> + scoped_guard(mutex, &reboot->rb_lock) {
>> + list_for_each_entry(info, &reboot->head, list)
>> + kfree_const(info->mode);
>> + }
>
> Please destroy the mutex here.
sure thanks. will add destroy here.
thanks,
Shivendra
Powered by blists - more mailing lists