linux-kernel - Re: [tip: irq/core] genirq: Warn about using IRQF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260207154218.2053c98c@jic23-huawei>
Date: Sat, 7 Feb 2026 15:42:18 +0000
From: Jonathan Cameron <jic23@...nel.org>
To: srinivas pandruvada <srinivas.pandruvada@...ux.intel.com>
Cc: Sebastian Andrzej Siewior <bigeasy@...utronix.de>, Bert Karwatzki 
 <spasswolf@....de>, linux-kernel@...r.kernel.org,
 linux-iio@...r.kernel.org, Jiri Kosina  <jikos@...nel.org>, Thomas Gleixner
  <tglx@...nel.org>, Laurent Pinchart <laurent.pinchart@...asonboard.com>
Subject: Re: [tip: irq/core] genirq: Warn about using IRQF_ONESHOT without a
 threaded handler

On Tue, 03 Feb 2026 09:29:25 -0800
srinivas pandruvada <srinivas.pandruvada@...ux.intel.com> wrote:

> On Tue, 2026-02-03 at 09:38 +0100, Sebastian Andrzej Siewior wrote:
> > On 2026-02-03 00:27:40 [+0100], Bert Karwatzki wrote:  
> > > 
> > > The warning appears because iio_triggered_buffer_setup_ext() (in 
> > > drivers/iio/buffer/industrialio-triggered-buffer.c) is called with
> > > thread = NULL
> > > during the probe of the iio device and calls iio_alloc_pollfunc()
> > > (in drivers/iio/industrialio-trigger.c) with thread = NULL and type
> > > = IRQF_ONESHOT.
> > > 
> > > A simple fix could be this:
> > > 
> > > diff --git a/drivers/iio/buffer/industrialio-triggered-buffer.c
> > > b/drivers/iio/buffer/industrialio-triggered-buffer.c
> > > index 9bf75dee7ff8..40eea3a44724 100644
> > > --- a/drivers/iio/buffer/industrialio-triggered-buffer.c
> > > +++ b/drivers/iio/buffer/industrialio-triggered-buffer.c
> > > @@ -64,7 +64,7 @@ int iio_triggered_buffer_setup_ext(struct iio_dev
> > > *indio_dev,
> > >  
> > >         indio_dev->pollfunc = iio_alloc_pollfunc(h,
> > >                                                  thread,
> > > -                                                IRQF_ONESHOT,
> > > +                                                thread ?
> > > IRQF_ONESHOT : 0,
> > >                                                  indio_dev,
> > >                                                  "%s_consumer%d",
> > >                                                  indio_dev->name,
> > > 
> > > 
> > > Are there any problems with this?  
> > 
> > Urgh. Haven't seen those.
> > 
> > Looking at all the users of of *iio_triggered_buffer_setup*() the
> > primary handler is either NULL or iio_pollfunc_store_time(). 
> > So IRQF_ONESHOST should work all the time.
> > 
> > Then there is 
> > - drivers/iio/adc/vf610_adc.c 
> > - drivers/iio/common/hid-sensors/hid-sensor-trigger.c
> > 
> > They use iio_pollfunc_store_time() as primary and have no secondary.
> > This would trigger the warning but not having a secondary handler
> > while
> > returning IRQF_WAKE_THREAD should create a warning of its own.
> > What did I miss?
> >   
> 
> hid-sensor doesn't need a bh handler. This patch can fix. 
> 
> diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
> b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
> index 5540e2d28f4a..b2b09b544f43 100644
> --- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
> +++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
> @@ -227,6 +227,11 @@ static const struct iio_trigger_ops
> hid_sensor_trigger_ops = {
>         .set_trigger_state = &hid_sensor_data_rdy_trigger_set_state,
>  };
>  
> +static irqreturn_t triggered_buffer_handler(int irq, void *p)
> +{
> +        return IRQ_HANDLED;
> +}
> +
>  int hid_sensor_setup_trigger(struct iio_dev *indio_dev, const char
> *name,
>                                 struct hid_sensor_common *attrb)
>  {
> @@ -240,7 +245,8 @@ int hid_sensor_setup_trigger(struct iio_dev
> *indio_dev, const char *name,
>                 fifo_attrs = NULL;
>  
>         ret = iio_triggered_buffer_setup_ext(indio_dev,
> -                                            &iio_pollfunc_store_time,
> NULL,
> +                                            &iio_pollfunc_store_time,
> +                                            triggered_buffer_handler,
>                                              IIO_BUFFER_DIRECTION_IN,
>                                              NULL, fifo_attrs);
>         if (ret) {
> 
> 
> Or add it to industrialio-triggered-buffer.c as a common handler for
> all caller with no bh, whatever Jonathan prefers.

I'm confused about how this works today.  Why do we store a timestamp
in the pollfunc structure that is never used by a bottom half?

If we have an actual top half that doesn't need a bottom half, then the
core code can easily insert a dummy handler, or register something sensible
in the first place.
 
Jonathan

> 
> 
> Thanks,
> Srinivas
> 
> 
> 
> > > Bert Karwatzki  
> > 
> > Sebastian