From: Yu Liao <liaoyu15@huawei.com>
To: <alexandre.belloni@bootlin.com>, <a.zummo@towertech.it>
Cc: <liaoyu15@huawei.com>, <liwei391@huawei.com>,
<linux-kernel@vger.kernel.org>, <linux-rtc@vger.kernel.org>
Subject: [RFC PATCH 2/2] rtc: fix race condition in rtc_set_time()
Date: Wed, 26 Oct 2022 11:33:48 +0800 [thread overview]
Message-ID: <20221026033348.1660732-3-liaoyu15@huawei.com> (raw)
In-Reply-To: <20221026033348.1660732-1-liaoyu15@huawei.com>
Commit 7e7c005b4b1f ("rtc: disable uie before setting time and enable
after") was introduced to solve problem that rtc_timer_do_work will loop
for a while, when setting the time in the future with the uie timer
enabled. But reading uie timer state and setting rtc time are not in
a critical section, a race condition may occur in rtc_set_time which
has two issues:
1) In the above scenario, rtc_timer_do_work may still loop for a while.
For example consider the following sequence:
CPU0 CPU1
---- ----
ioctl(RTC_SET_TIME) ioctl(RTC_UIE_ON)
uie = rtc->uie_rtctimer.enabled;
[ assume uie is 0 ]
if (uie)
rtc_update_irq_enable(rtc, 0);
rtc_update_irq_enable(rtc, 1);
[ uie is enabled ]
rtc->ops->set_time();
[ set rtc time in the future ]
2) A thread try to turn off uie, however rtc_settime called by another
thread turns on uie when they run in parallel. Consider the following
sequence:
CPU0 CPU1
---- ----
ioctl(RTC_SET_TIME) ioctl(RTC_UIE_OFF)
rtc->ops->set_time();
rtc_update_irq_enable(rtc, 0);
rtc_update_irq_enable(rtc, 1);
Fix it by guaranteeing that reading uie timer state, setting rtc time
and enabling uie timer within a critical section.
Fixes: 7e7c005b4b1f ("rtc: disable uie before setting time and enable after")
Signed-off-by: Yu Liao <liaoyu15@huawei.com>
---
drivers/rtc/interface.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
index bc55dd31bece..00a6173d8895 100644
--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -139,21 +139,21 @@ int rtc_set_time(struct rtc_device *rtc, struct rtc_time *tm)
rtc_subtract_offset(rtc, tm);
+ err = mutex_lock_interruptible(&rtc->ops_lock);
+ if (err)
+ return err;
+
#ifdef CONFIG_RTC_INTF_DEV_UIE_EMUL
uie = rtc->uie_rtctimer.enabled || rtc->uie_irq_active;
#else
uie = rtc->uie_rtctimer.enabled;
#endif
if (uie) {
- err = rtc_update_irq_enable(rtc, 0);
+ err = __rtc_update_irq_enable(rtc, 0);
if (err)
return err;
}
- err = mutex_lock_interruptible(&rtc->ops_lock);
- if (err)
- return err;
-
if (!rtc->ops)
err = -ENODEV;
else if (rtc->ops->set_time)
@@ -162,15 +162,15 @@ int rtc_set_time(struct rtc_device *rtc, struct rtc_time *tm)
err = -EINVAL;
pm_stay_awake(rtc->dev.parent);
- mutex_unlock(&rtc->ops_lock);
/* A timer might have just expired */
schedule_work(&rtc->irqwork);
if (uie) {
- err = rtc_update_irq_enable(rtc, 1);
+ err = __rtc_update_irq_enable(rtc, 1);
if (err)
return err;
}
+ mutex_unlock(&rtc->ops_lock);
trace_rtc_set_time(rtc_tm_to_time64(tm), err);
return err;
--
2.25.1
prev parent reply other threads:[~2022-10-26 3:35 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-26 3:33 [RFC PATCH 0/2] rtc: fix race condition between uie enable and rtc set time Yu Liao
2022-10-26 3:33 ` [RFC PATCH 1/2] rtc: add lockless rtc_update_irq_enable Yu Liao
2022-10-26 3:33 ` Yu Liao [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221026033348.1660732-3-liaoyu15@huawei.com \
--to=liaoyu15@huawei.com \
--cc=a.zummo@towertech.it \
--cc=alexandre.belloni@bootlin.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rtc@vger.kernel.org \
--cc=liwei391@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).