[PATCH 1/2] EDAC/device_sysfs: Use kstrtouint for poll_msec to prevent truncation

[PATCH 1/2] EDAC/device_sysfs: Use kstrtouint for poll_msec to prevent truncation

[Jad Keskes]

The poll_msec sysfs store uses simple_strtoul() which accepts an
unsigned long, but the target field (poll_msec) is unsigned int. On
64-bit systems, a value > UINT_MAX is silently truncated when stored.

Fix the mismatch by using kstrtouint() instead. This rejects values
> UINT_MAX at parse time, making truncation impossible. Also add a
check for value < 1 to reject the 0-delay case, which would cause the
poll work to spin without delay and consume 100% CPU.

Fixes: e27e3dac6517 ("drivers/edac: add edac_device class")
Signed-off-by: Jad Keskes <inasj268@gmail.com>
---
 drivers/edac/edac_device_sysfs.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/edac/edac_device_sysfs.c b/drivers/edac/edac_device_sysfs.c
index ac678b4a21fc..e2ee5c6c56d3 100644
--- a/drivers/edac/edac_device_sysfs.c
+++ b/drivers/edac/edac_device_sysfs.c
@@ -90,14 +90,21 @@ static ssize_t edac_device_ctl_poll_msec_store(struct edac_device_ctl_info
 					*ctl_info, const char *data,
 					size_t count)
 {
-	unsigned long value;
+	unsigned int value;
+	int ret;
 
 	/* get the value and enforce that it is non-zero, must be at least
 	 * one millisecond for the delay period, between scans
 	 * Then cancel last outstanding delay for the work request
 	 * and set a new one.
 	 */
-	value = simple_strtoul(data, NULL, 0);
+	ret = kstrtouint(data, 0, &value);
+	if (ret < 0)
+		return ret;
+
+	if (value < 1)
+		return -EINVAL;
+
 	edac_device_reset_delay_period(ctl_info, value);
 
 	return count;
-- 
2.55.0

[PATCH 2/2] EDAC/device: Serialize poll_msec store against device teardown

[Jad Keskes]

edac_device_reset_delay_period() unconditionally calls edac_mod_work()
to re-arm the workqueue timer when the poll_msec sysfs attribute is
written. This has two issues:

 1) Interrupt-driven devices (op_state = OP_RUNNING_INTERRUPT) have
    no initialized workqueue, so calling edac_mod_work() would operate
    on uninitialized timer state.

 2) A concurrent write to poll_msec during device removal can race
    with edac_device_del_device(). Even with an OP_OFFLINE state check,
    the check and edac_mod_work() are not atomic, allowing the workqueue
    to be re-armed after teardown.

Fix both by holding device_ctls_mutex around the state check and
edac_mod_work() call in reset_delay_period(), and moving the workqueue
teardown inside the same mutex in del_device(). With the mutex held in
both paths:

  - reset_delay_period() atomically verifies op_state == OP_RUNNING_POLL
    before re-arming; any other state skips the call entirely.
  - del_device() sets OP_OFFLINE and tears down the workqueue while
    holding the mutex, so any racing reset_delay_period() completes
    before teardown or sees OP_OFFLINE and bails.

Also fix the parameter type from unsigned long to unsigned int to match
the poll_msec field, and fix a latent bug where round_jiffies_relative()
received a millisecond value instead of jiffies.

Signed-off-by: Jad Keskes <inasj268@gmail.com>
---
 drivers/edac/edac_device.c | 15 +++++++++++----
 drivers/edac/edac_module.h |  2 +-
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/drivers/edac/edac_device.c b/drivers/edac/edac_device.c
index 19522c568aa5..3fb4de3ed28c 100644
--- a/drivers/edac/edac_device.c
+++ b/drivers/edac/edac_device.c
@@ -394,17 +394,24 @@ static void edac_device_workq_teardown(struct edac_device_ctl_info *edac_dev)
  *	Then restart the workq on the new delay
  */
 void edac_device_reset_delay_period(struct edac_device_ctl_info *edac_dev,
-					unsigned long value)
+				    unsigned int value)
 {
 	unsigned long jiffs = msecs_to_jiffies(value);
 
 	if (value == 1000)
-		jiffs = round_jiffies_relative(value);
+		jiffs = round_jiffies_relative(jiffs);
+
+	mutex_lock(&device_ctls_mutex);
+	if (edac_dev->op_state != OP_RUNNING_POLL) {
+		mutex_unlock(&device_ctls_mutex);
+		return;
+	}
 
 	edac_dev->poll_msec = value;
 	edac_dev->delay	    = jiffs;
 
 	edac_mod_work(&edac_dev->work, jiffs);
+	mutex_unlock(&device_ctls_mutex);
 }
 
 int edac_device_alloc_index(void)
@@ -492,11 +499,11 @@ struct edac_device_ctl_info *edac_device_del_device(struct device *dev)
 	/* deregister from global list */
 	del_edac_device_from_global_list(edac_dev);
 
-	mutex_unlock(&device_ctls_mutex);
-
 	/* clear workq processing on this instance */
 	edac_device_workq_teardown(edac_dev);
 
+	mutex_unlock(&device_ctls_mutex);
+
 	/* Tear down the sysfs entries for this instance */
 	edac_device_remove_sysfs(edac_dev);
 
diff --git a/drivers/edac/edac_module.h b/drivers/edac/edac_module.h
index 96f6de0c8ff6..e03ec7daa64a 100644
--- a/drivers/edac/edac_module.h
+++ b/drivers/edac/edac_module.h
@@ -56,7 +56,7 @@ bool edac_stop_work(struct delayed_work *work);
 bool edac_mod_work(struct delayed_work *work, unsigned long delay);
 
 extern void edac_device_reset_delay_period(struct edac_device_ctl_info
-					   *edac_dev, unsigned long value);
+					   *edac_dev, unsigned int value);
 extern void edac_mc_reset_delay_period(unsigned long value);
 
 /*
-- 
2.55.0