From: Tzung-Bi Shih <tzungbi@kernel.org>
To: Jason Gunthorpe <jgg@nvidia.com>
Cc: Benson Leung <bleung@chromium.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
chrome-platform@lists.linux.dev, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2 4/4] platform/chrome: cros_ec_chardev: Introduce rwsem for protecting ec_dev
Date: Mon, 25 May 2026 05:43:32 +0000 [thread overview]
Message-ID: <ahPhhLyLsopo8XXU@google.com> (raw)
In-Reply-To: <20260521135830.GH3602937@nvidia.com>
On Thu, May 21, 2026 at 10:58:30AM -0300, Jason Gunthorpe wrote:
> On Sat, May 16, 2026 at 10:30:17PM +0800, Tzung-Bi Shih wrote:
> > @@ -330,10 +350,18 @@ static long cros_ec_chardev_ioctl_xcmd(struct chardev_priv *priv, void __user *a
> > }
> >
> > s_cmd->command += priv->pdata->cmd_offset;
> > - ret = cros_ec_cmd_xfer(priv->pdata->ec_dev, s_cmd);
> > - /* Only copy data to userland if data was received. */
> > - if (ret < 0)
> > - goto exit;
> > +
> > + scoped_guard(rwsem_read, &priv->pdata->ec_dev_sem) {
> > + if (!priv->pdata->ec_dev) {
> > + ret = -ENODEV;
> > + goto exit;
> > + }
>
> Same remark, don't use scoped_guard. Each fops should simply start
> with:
>
> guard(rwsem_read)(&priv->pdata->ec_dev_sem);
> if (!priv->pdata->ec_dev)
> return -ENXIO;
>
> There is no point in trying to carefully partially do some part of the
> ioctl of the driver has been removed.
Fixed those in the next version [1].
Just a note, the code still uses -ENODEV instead of -ENXIO if you have no
objection.
> > @@ -451,6 +485,8 @@ static void cros_ec_chardev_remove(struct platform_device *pdev)
> >
> > blocking_notifier_chain_unregister(&pdata->ec_dev->event_notifier,
> > &pdata->relay);
> > + scoped_guard(rwsem_write, &pdata->ec_dev_sem)
> > + pdata->ec_dev = NULL;
>
> This seems out of order.
>
> misc_deregister(&pdata->misc);
>
> ^^ Is first because it stops new fops from being created
>
> + scoped_guard(rwsem_write, &pdata->ec_dev_sem)
> + pdata->ec_dev = NULL;
>
> ^^ Stops existing fops from running
>
> Then you can go on to destroy the notifier chain and so on as there is
> now no concurrent touches to pdata.
Fixed in the next version [1].
[1] https://lore.kernel.org/all/20260525052654.4076429-5-tzungbi@kernel.org
next prev parent reply other threads:[~2026-05-25 5:43 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-16 14:30 [PATCH v2 0/4] platform/chrome: cros_ec_chardev: Fix a potential UAF Tzung-Bi Shih
2026-05-16 14:30 ` [PATCH v2 1/4] platform/chrome: cros_ec_chardev: Introduce chardev_data Tzung-Bi Shih
2026-05-16 14:30 ` [PATCH v2 2/4] platform/chrome: cros_ec_chardev: Move data to chardev_pdata Tzung-Bi Shih
2026-05-16 14:30 ` [PATCH v2 3/4] platform/chrome: cros_ec_chardev: Add event relayer Tzung-Bi Shih
2026-05-16 14:30 ` [PATCH v2 4/4] platform/chrome: cros_ec_chardev: Introduce rwsem for protecting ec_dev Tzung-Bi Shih
2026-05-21 13:58 ` Jason Gunthorpe
2026-05-25 5:43 ` Tzung-Bi Shih [this message]
2026-05-21 14:06 ` [PATCH v2 0/4] platform/chrome: cros_ec_chardev: Fix a potential UAF Jason Gunthorpe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ahPhhLyLsopo8XXU@google.com \
--to=tzungbi@kernel.org \
--cc=bleung@chromium.org \
--cc=chrome-platform@lists.linux.dev \
--cc=gregkh@linuxfoundation.org \
--cc=jgg@nvidia.com \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.