linux-kernel - Re: [PATCH] hwmon: (max6620) Add locking to avoid TOCTOU

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20251128200135.26000eed@pumpkin>
Date: Fri, 28 Nov 2025 20:06:34 +0000
From: david laight <david.laight@...box.com>
To: Gui-Dong Han <hanguidong02@...il.com>
Cc: Guenter Roeck <linux@...ck-us.net>, linux-hwmon@...r.kernel.org,
 linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH] hwmon: (max6620) Add locking to avoid TOCTOU

On Sat, 29 Nov 2025 01:59:51 +0800
Gui-Dong Han <hanguidong02@...il.com> wrote:

...
> In our previous discussion, you also suggested adding a note to
> submitting-patches.rst about "avoiding calculations in macros" to
> explicitly explain the risk of race conditions. Is this something you
> would still like to see added? If so, I would be happy to prepare a
> patch.

The real problem with #defines evaluating their parameters more than
once is just side effects of the expansion.
Even if the current users just pass a simple variable, you never
really know what is going to happen in the future.

There is also a secondary issue of pre-processor output 'bloat'.
This happens when large #define expansions get nested.
With the current headers FIELD_PREP(GENMASK(8, 5), val) expands to
about 18kB [1] (even though it is just (val >> 5) & 15).
I think one of your #defines get passed one of those - and then expands
it several times. As well as the massive line, the compiler may well
generate the code multiple times.
(CSE will normally stop foo->bar[x] being executed multiple times).

[1] Nothing like the 30MB that triple nested min() generated for a while.

	David