From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A7E5C433DF for ; Thu, 4 Jun 2020 23:51:24 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 31032206DC for ; Thu, 4 Jun 2020 23:51:24 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=kernel.org header.i=@kernel.org header.b="I4GcnQuN" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 31032206DC Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=linux-foundation.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id C7725280064; Thu, 4 Jun 2020 19:51:23 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id C2627280005; Thu, 4 Jun 2020 19:51:23 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A9F94280064; Thu, 4 Jun 2020 19:51:23 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0145.hostedemail.com [216.40.44.145]) by kanga.kvack.org (Postfix) with ESMTP id 8D705280005 for ; Thu, 4 Jun 2020 19:51:23 -0400 (EDT) Received: from smtpin27.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 43E18180AD806 for ; Thu, 4 Jun 2020 23:51:23 +0000 (UTC) X-FDA: 76893178446.27.kiss13_130512e26d9b Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin27.hostedemail.com (Postfix) with ESMTP id 20EBD3D663 for ; Thu, 4 Jun 2020 23:51:23 +0000 (UTC) X-HE-Tag: kiss13_130512e26d9b X-Filterd-Recvd-Size: 4040 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by imf29.hostedemail.com (Postfix) with ESMTP for ; Thu, 4 Jun 2020 23:51:22 +0000 (UTC) Received: from localhost.localdomain (c-73-231-172-41.hsd1.ca.comcast.net [73.231.172.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 7BBF42067B; Thu, 4 Jun 2020 23:51:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591314682; bh=3k98dHBqnHjlagwA400Xlg+7Yj3n/lY8Wg1Q+jKAEd4=; h=Date:From:To:Subject:In-Reply-To:From; b=I4GcnQuN4OquIRnU7i1V4gpBbhg8+n8aQIAdWl9WBqfjBUJWgCId1KMEy8dQyUItD bM2/PjD9AHkS3iQZYpy7rW83LNXgqQerZLIc6MPx4pFqhbyhTrL3q2TRlTqwa52Uy8 j7ZBAiaZ4XxX4zuzxDHvbbaknI/PUMXdUyJcsh2c= Date: Thu, 04 Jun 2020 16:51:21 -0700 From: Andrew Morton To: akpm@linux-foundation.org, alex.bou9@gmail.com, allison@lohutok.net, andrianov@ispras.ru, dan.carpenter@oracle.com, hubcap@omnibond.com, ira.weiny@intel.com, linux-mm@kvack.org, madhuparnabhowmik10@gmail.com, mm-commits@vger.kernel.org, mporter@kernel.crashing.org, tglx@linutronix.de, torvalds@linux-foundation.org Subject: [patch 098/127] rapidio: avoid data race between file operation callbacks and mport_cdev_add(). Message-ID: <20200604235121.hGbvMcUI8%akpm@linux-foundation.org> In-Reply-To: <20200604164523.e15f3177f4b69dcb4f2534a1@linux-foundation.org> User-Agent: s-nail v14.8.16 X-Rspamd-Queue-Id: 20EBD3D663 X-Spamd-Result: default: False [0.00 / 100.00] X-Rspamd-Server: rspam04 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Madhuparna Bhowmik Subject: rapidio: avoid data race between file operation callbacks and mport_cdev_add(). Fields of md(mport_dev) are set after cdev_device_add(). However, the file operation callbacks can be called after cdev_device_add() and therefore accesses to fields of md in the callbacks can race with the rest of the mport_cdev_add() function. One such example is INIT_LIST_HEAD(&md->portwrites) in mport_cdev_add(), the list is initialised after cdev_device_add(). This can race with list_add_tail(&pw_filter->md_node,&md->portwrites) in rio_mport_add_pw_filter() which is called by unlocked_ioctl. To avoid such data races use cdev_device_add() after initializing md. Found by Linux Driver Verification project (linuxtesting.org). Link: http://lkml.kernel.org/r/20200426112950.1803-1-madhuparnabhowmik10@gmail.com Signed-off-by: Madhuparna Bhowmik Acked-by: Alexandre Bounine Cc: Matt Porter Cc: Dan Carpenter Cc: Mike Marshall Cc: Thomas Gleixner Cc: Ira Weiny Cc: Allison Randal Cc: Pavel Andrianov Signed-off-by: Andrew Morton --- drivers/rapidio/devices/rio_mport_cdev.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) --- a/drivers/rapidio/devices/rio_mport_cdev.c~rapidio-avoid-data-race-between-file-operation-callbacks-and-mport_cdev_add +++ a/drivers/rapidio/devices/rio_mport_cdev.c @@ -2384,13 +2384,6 @@ static struct mport_dev *mport_cdev_add( cdev_init(&md->cdev, &mport_fops); md->cdev.owner = THIS_MODULE; - ret = cdev_device_add(&md->cdev, &md->dev); - if (ret) { - rmcd_error("Failed to register mport %d (err=%d)", - mport->id, ret); - goto err_cdev; - } - INIT_LIST_HEAD(&md->doorbells); spin_lock_init(&md->db_lock); INIT_LIST_HEAD(&md->portwrites); @@ -2410,6 +2403,13 @@ static struct mport_dev *mport_cdev_add( #else md->properties.transfer_mode |= RIO_TRANSFER_MODE_TRANSFER; #endif + + ret = cdev_device_add(&md->cdev, &md->dev); + if (ret) { + rmcd_error("Failed to register mport %d (err=%d)", + mport->id, ret); + goto err_cdev; + } ret = rio_query_mport(mport, &attr); if (!ret) { md->properties.flags = attr.flags; _