linux-kernel - [PATCH] PM: sleep: wakeirq: harden dev_pm_clear_wake

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20260131101254.56423-1-hanguidong02@gmail.com>
Date: Sat, 31 Jan 2026 18:12:54 +0800
From: Gui-Dong Han <hanguidong02@...il.com>
To: rafael@...nel.org,
	pavel@...nel.org,
	lenb@...nel.org,
	gregkh@...uxfoundation.org,
	dakr@...nel.org
Cc: linux-pm@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	baijiaju1990@...il.com,
	Gui-Dong Han <hanguidong02@...il.com>
Subject: [PATCH] PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races

dev_pm_clear_wake_irq() currently uses a dangerous pattern where
dev->power.wakeirq is read and checked for NULL outside the lock. If two
callers invoke this function concurrently, both might see a valid
pointer and proceed. This could result in a double-free when the second
caller acquires the lock and tries to release the same object.

Address this by using double-checked locking. This retains the
performance benefit of avoiding the lock when dev->power.wakeirq is
NULL, consistent with the original logic, but adds a necessary re-check
after acquiring dev->power.lock. Additionally, use READ_ONCE() and
WRITE_ONCE() to annotate the shared variable accesses to avoid data races
as defined by the kernel documentation.

Based on a quick scan of current users, I did not find an actual bug as
drivers seem to rely on their own synchronization. However, since
asynchronous usage patterns exist (e.g., in
drivers/net/wireless/ti/wlcore), I believe a race is theoretically
possible if the API is used less carefully in the future. This change
hardens the API to be robust against such cases.

Fixes: 4990d4fe327b ("PM / Wakeirq: Add automated device wake IRQ handling")
Signed-off-by: Gui-Dong Han <hanguidong02@...il.com>
---
While studying wakeirq, I noticed dev_pm_clear_wake_irq() handles
sequential re-entry (via the NULL check) but may lead to a double-free
on concurrent calls.

I considered whether we should simply document that concurrent calls are
forbidden. However, since the double-check locking pattern is
straightforward and adds negligible performance overhead (we still skip
the lock in the NULL case), I believe hardening the API is the better
approach.

I also noticed comments for dev_pm_enable_wake_irq_check() and friends
appear outdated. They claim "Caller must hold &dev->power.lock" and
limit usage to rpm_suspend/resume, yet pm_runtime_force_suspend/resume()
now call them lockless. While this usage appears safe due to the specific
context, it conflicts with the comments.

I can submit a follow-up patch to fix this doc drift but am unsure
whether to simply remove the restriction text or complicate it with
exceptions. Guidance is welcome.
---
 drivers/base/power/wakeirq.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/base/power/wakeirq.c b/drivers/base/power/wakeirq.c
index 8aa28c08b289..acb520626195 100644
--- a/drivers/base/power/wakeirq.c
+++ b/drivers/base/power/wakeirq.c
@@ -30,7 +30,7 @@ static int dev_pm_attach_wake_irq(struct device *dev, struct wake_irq *wirq)
 		return -EEXIST;
 	}

-	dev->power.wakeirq = wirq;
+	WRITE_ONCE(dev->power.wakeirq, wirq);
 	device_wakeup_attach_irq(dev, wirq);

 	spin_unlock_irqrestore(&dev->power.lock, flags);
@@ -83,15 +83,21 @@ EXPORT_SYMBOL_GPL(dev_pm_set_wake_irq);
  */
 void dev_pm_clear_wake_irq(struct device *dev)
 {
-	struct wake_irq *wirq = dev->power.wakeirq;
+	struct wake_irq *wirq = READ_ONCE(dev->power.wakeirq);
 	unsigned long flags;

 	if (!wirq)
 		return;

 	spin_lock_irqsave(&dev->power.lock, flags);
+	wirq = dev->power.wakeirq;
+	if (!wirq) {
+		spin_unlock_irqrestore(&dev->power.lock, flags);
+		return;
+	}
+
 	device_wakeup_detach_irq(dev);
-	dev->power.wakeirq = NULL;
+	WRITE_ONCE(dev->power.wakeirq, NULL);
 	spin_unlock_irqrestore(&dev->power.lock, flags);

 	if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED) {
-- 
2.43.0