* drivers/char/ppdev -
@ 2020-10-02 21:01 Shuah Khan
0 siblings, 0 replies; only message in thread
From: Shuah Khan @ 2020-10-02 21:01 UTC (permalink / raw)
To: sudipm.mukherjee
Cc: Arnd Bergmann, Greg Kroah-Hartman, linux-kernel, Shuah Khan
Hi Sudip,
While looking at atomic_t usages and noticed a few potential
problem the way struct pp_struct: atomic_t irqc field
- There is inconsistencies the lock hold in this driver.
pp_do_mutex is help before pp_do_ioctl() is called.
static int pp_do_ioctl()
....
pp_do_mutex
case PPCLRIRQ:
ret = atomic_read(&pp->irqc);
if (copy_to_user(argp, &ret, sizeof(ret)))
return -EFAULT;
atomic_sub(ret, &pp->irqc);
return 0;
This path seems safe as far as atomic_t overflow is concerned.
However, pp_poll(), pp_irq(), and pp_open() etc. don't hold
lock while pp_do_ioctl() path does.
Something to look into to see if this is safe. I see this
comment for pp_poll() /* No kernel lock held - fine */
Anyway, please take a look and see if this is indeed a problem.
thanks,
-- Shuah
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2020-10-02 21:01 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-02 21:01 drivers/char/ppdev - Shuah Khan
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).