[PATCH V4 0/2] rpmsg_char/ctrl driver fixes

[PATCH V4 0/2] rpmsg_char/ctrl driver fixes

[Deepak Kumar Singh]

Change from v4:
Corrcted mistaked in commit message for patch2.

Deepak Kumar Singh (2):
  rpmsg: glink: Add lock to avoid race when rpmsg device is released
  rpmsg: glink: Add lock to rpmsg_ctrldev_remove

 drivers/rpmsg/rpmsg_char.c | 8 ++++++++
 drivers/rpmsg/rpmsg_ctrl.c | 2 ++
 2 files changed, 10 insertions(+)

-- 
2.7.4

[PATCH V5 1/2] rpmsg: char: Add lock to avoid race when rpmsg device is released

[Deepak Kumar Singh]

When remote host goes down glink char device channel is freed and
associated rpdev is destroyed through rpmsg_chrdev_eptdev_destroy(),
At the same time user space apps can still try to open/poll rpmsg
char device which will result in calling rpmsg_create_ept()/rpmsg_poll().
These functions will try to reference rpdev which has already been freed
through rpmsg_chrdev_eptdev_destroy().

File operation functions and device removal function must be protected
with lock. This patch adds existing ept lock in remove function as well.

Signed-off-by: Deepak Kumar Singh <quic_deesin@quicinc.com>
---
 drivers/rpmsg/rpmsg_char.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/rpmsg/rpmsg_char.c b/drivers/rpmsg/rpmsg_char.c
index 4f21891..5500dc0 100644
--- a/drivers/rpmsg/rpmsg_char.c
+++ b/drivers/rpmsg/rpmsg_char.c
@@ -75,6 +75,7 @@ int rpmsg_chrdev_eptdev_destroy(struct device *dev, void *data)
 	struct rpmsg_eptdev *eptdev = dev_to_eptdev(dev);
 
 	mutex_lock(&eptdev->ept_lock);
+	eptdev->rpdev = NULL;
 	if (eptdev->ept) {
 		rpmsg_destroy_ept(eptdev->ept);
 		eptdev->ept = NULL;
@@ -126,6 +127,11 @@ static int rpmsg_eptdev_open(struct inode *inode, struct file *filp)
 		return -EBUSY;
 	}
 
+	if (!eptdev->rpdev) {
+		mutex_unlock(&eptdev->ept_lock);
+		return -ENETRESET;
+	}
+
 	get_device(dev);
 
 	/*
@@ -277,7 +283,9 @@ static __poll_t rpmsg_eptdev_poll(struct file *filp, poll_table *wait)
 	if (!skb_queue_empty(&eptdev->queue))
 		mask |= EPOLLIN | EPOLLRDNORM;
 
+	mutex_lock(&eptdev->ept_lock);
 	mask |= rpmsg_poll(eptdev->ept, filp, wait);
+	mutex_unlock(&eptdev->ept_lock);
 
 	return mask;
 }
-- 
2.7.4

[PATCH V5 2/2] rpmsg: ctrl: Add lock to rpmsg_ctrldev_remove

[Deepak Kumar Singh]

Call to rpmsg_ctrldev_ioctl() and rpmsg_ctrldev_remove() must be synchronized.
In present code rpmsg_ctrldev_remove() is not protected with lock, therefore
new char device creation can succeed through rpmsg_ctrldev_ioctl() call. At the
same time call to rpmsg_ctrldev_remove() function for ctrl device removal will
free associated rpdev device. As char device creation already succeeded, user
space is free to issue open() call which maps to rpmsg_create_ept() in kernel.
rpmsg_create_ept() function tries to reference rpdev which has already been
freed through rpmsg_ctrldev_remove(). Issue is predominantly seen in aggressive
reboot tests where rpmsg_ctrldev_ioctl() and rpmsg_ctrldev_remove() can race with
each other.

Adding lock in rpmsg_ctrldev_remove() avoids any new char device creation
through rpmsg_ctrldev_ioctl() while remove call is already in progress.

Signed-off-by: Deepak Kumar Singh <quic_deesin@quicinc.com>
---
 drivers/rpmsg/rpmsg_ctrl.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/rpmsg/rpmsg_ctrl.c b/drivers/rpmsg/rpmsg_ctrl.c
index 107da70..4332538 100644
--- a/drivers/rpmsg/rpmsg_ctrl.c
+++ b/drivers/rpmsg/rpmsg_ctrl.c
@@ -194,10 +194,12 @@ static void rpmsg_ctrldev_remove(struct rpmsg_device *rpdev)
 	struct rpmsg_ctrldev *ctrldev = dev_get_drvdata(&rpdev->dev);
 	int ret;
 
+	mutex_lock(&ctrldev->ctrl_lock);
 	/* Destroy all endpoints */
 	ret = device_for_each_child(&ctrldev->dev, NULL, rpmsg_chrdev_eptdev_destroy);
 	if (ret)
 		dev_warn(&rpdev->dev, "failed to nuke endpoints: %d\n", ret);
+	mutex_unlock(&ctrldev->ctrl_lock);
 
 	cdev_device_del(&ctrldev->cdev, &ctrldev->dev);
 	put_device(&ctrldev->dev);
-- 
2.7.4

Re: [PATCH V4 0/2] rpmsg_char/ctrl driver fixes

[Mathieu Poirier]

On Mon, Sep 19, 2022 at 04:23:58PM +0530, Deepak Kumar Singh wrote:
> Change from v4:
> Corrcted mistaked in commit message for patch2.
> 
> Deepak Kumar Singh (2):
>   rpmsg: glink: Add lock to avoid race when rpmsg device is released
>   rpmsg: glink: Add lock to rpmsg_ctrldev_remove
>

Why does 'glink' still shows up in this cover letter and the version number wrong?


>  drivers/rpmsg/rpmsg_char.c | 8 ++++++++
>  drivers/rpmsg/rpmsg_ctrl.c | 2 ++
>  2 files changed, 10 insertions(+)
> 
> -- 
> 2.7.4
> 

Re: (subset) [PATCH V4 0/2] rpmsg_char/ctrl driver fixes

[Bjorn Andersson]

On Mon, 19 Sep 2022 16:23:58 +0530, Deepak Kumar Singh wrote:
> Change from v4:
> Corrcted mistaked in commit message for patch2.
> 
> Deepak Kumar Singh (2):
>   rpmsg: glink: Add lock to avoid race when rpmsg device is released
>   rpmsg: glink: Add lock to rpmsg_ctrldev_remove
> 
> [...]

Applied, thanks!

[1/2] rpmsg: char: Add lock to avoid race when rpmsg device is released
      commit: 17b88a2050e9d1f89a53562f2adb709a8959e763
[2/2] rpmsg: ctrl: Add lock to rpmsg_ctrldev_remove
      commit: c23965b7f7d99bbb2604f1f02aa26fb6d1d5864d

Best regards,
-- 
Bjorn Andersson <andersson@kernel.org>

[PATCH V4 0/2] rpmsg_char/ctrl driver fixes

[Deepak Kumar Singh]

Change from v3:
Corrcted subject line pf patches.

Deepak Kumar Singh (2):
  rpmsg: glink: Add lock to avoid race when rpmsg device is released
  rpmsg: glink: Add lock to rpmsg_ctrldev_remove

 drivers/rpmsg/rpmsg_char.c | 8 ++++++++
 drivers/rpmsg/rpmsg_ctrl.c | 2 ++
 2 files changed, 10 insertions(+)

-- 
2.7.4