[RFC PATCH 0/2] rtc: fix race condition between uie enable and rtc set time

[RFC PATCH 0/2] rtc: fix race condition between uie enable and rtc set time

[Yu Liao]

The patch series fixes two issues in rtc_set_time caused by race
conditions:
- rtc_timer_do_work will loop for a while when setting rtc time in the
  future with uie enabled.
- RTC_UIE_OFF does not work when RTC_UIE_OFF and RTC_SET_TIME are
  running in parallel.

Patch #1 extracts lockless version from rtc_update_irq_enable, and
patch #2 addresses the race condition issue.

Yu Liao (2):
  rtc: add lockless rtc_update_irq_enable
  rtc: fix race condition in rtc_set_time()

 drivers/rtc/interface.c | 43 ++++++++++++++++++++++++-----------------
 1 file changed, 25 insertions(+), 18 deletions(-)

-- 
2.25.1

[RFC PATCH 1/2] rtc: add lockless rtc_update_irq_enable

[Yu Liao]

Split out a function that does not acquire rtc->ops_lock from
rtc_update_irq_enable, in preparation for fixing race condition in
rtc_set_time.

Signed-off-by: Yu Liao <liaoyu15@huawei.com>
---
 drivers/rtc/interface.c | 30 +++++++++++++++++++-----------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
index 9edd662c69ac..bc55dd31bece 100644
--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -19,6 +19,7 @@
 
 static int rtc_timer_enqueue(struct rtc_device *rtc, struct rtc_timer *timer);
 static void rtc_timer_remove(struct rtc_device *rtc, struct rtc_timer *timer);
+static int __rtc_update_irq_enable(struct rtc_device *rtc, unsigned int enabled);
 
 static void rtc_add_offset(struct rtc_device *rtc, struct rtc_time *tm)
 {
@@ -81,6 +82,7 @@ static int rtc_valid_range(struct rtc_device *rtc, struct rtc_time *tm)
 	return 0;
 }
 
+/* This function must be called with rtc->ops_lock held */
 static int __rtc_read_time(struct rtc_device *rtc, struct rtc_time *tm)
 {
 	int err;
@@ -553,27 +555,21 @@ int rtc_alarm_irq_enable(struct rtc_device *rtc, unsigned int enabled)
 }
 EXPORT_SYMBOL_GPL(rtc_alarm_irq_enable);
 
-int rtc_update_irq_enable(struct rtc_device *rtc, unsigned int enabled)
+static int __rtc_update_irq_enable(struct rtc_device *rtc, unsigned int enabled)
 {
-	int err;
-
-	err = mutex_lock_interruptible(&rtc->ops_lock);
-	if (err)
-		return err;
+	int err = 0;
 
 #ifdef CONFIG_RTC_INTF_DEV_UIE_EMUL
 	if (enabled == 0 && rtc->uie_irq_active) {
-		mutex_unlock(&rtc->ops_lock);
 		return rtc_dev_update_irq_enable_emul(rtc, 0);
 	}
 #endif
 	/* make sure we're changing state */
 	if (rtc->uie_rtctimer.enabled == enabled)
-		goto out;
+		return err;
 
 	if (!test_bit(RTC_FEATURE_UPDATE_INTERRUPT, rtc->features) ||
 	    !test_bit(RTC_FEATURE_ALARM, rtc->features)) {
-		mutex_unlock(&rtc->ops_lock);
 #ifdef CONFIG_RTC_INTF_DEV_UIE_EMUL
 		return rtc_dev_update_irq_enable_emul(rtc, enabled);
 #else
@@ -587,7 +583,7 @@ int rtc_update_irq_enable(struct rtc_device *rtc, unsigned int enabled)
 
 		err = __rtc_read_time(rtc, &tm);
 		if (err)
-			goto out;
+			return err;
 		onesec = ktime_set(1, 0);
 		now = rtc_tm_to_ktime(tm);
 		rtc->uie_rtctimer.node.expires = ktime_add(now, onesec);
@@ -597,7 +593,19 @@ int rtc_update_irq_enable(struct rtc_device *rtc, unsigned int enabled)
 		rtc_timer_remove(rtc, &rtc->uie_rtctimer);
 	}
 
-out:
+	return err;
+}
+
+int rtc_update_irq_enable(struct rtc_device *rtc, unsigned int enabled)
+{
+	int err;
+
+	err = mutex_lock_interruptible(&rtc->ops_lock);
+	if (err)
+		return err;
+
+	err = __rtc_update_irq_enable(rtc, enabled);
+
 	mutex_unlock(&rtc->ops_lock);
 
 	return err;
-- 
2.25.1

[RFC PATCH 2/2] rtc: fix race condition in rtc_set_time()

[Yu Liao]

Commit 7e7c005b4b1f ("rtc: disable uie before setting time and enable
after") was introduced to solve problem that rtc_timer_do_work will loop
for a while, when setting the time in the future with the uie timer
enabled. But reading uie timer state and setting rtc time are not in
a critical section, a race condition may occur in rtc_set_time which
has two issues:

1) In the above scenario, rtc_timer_do_work may still loop for a while.
   For example consider the following sequence:

   CPU0					CPU1
   ----					----
   ioctl(RTC_SET_TIME)			ioctl(RTC_UIE_ON)
   uie = rtc->uie_rtctimer.enabled;
   [ assume uie is 0 ]
   if (uie)
   	rtc_update_irq_enable(rtc, 0);

   					rtc_update_irq_enable(rtc, 1);
   					[ uie is enabled ]
   rtc->ops->set_time();
   [ set rtc time in the future ]

2) A thread try to turn off uie, however rtc_settime called by another
   thread turns on uie when they run in parallel. Consider the following
   sequence:

   CPU0					CPU1
   ----					----
   ioctl(RTC_SET_TIME)			ioctl(RTC_UIE_OFF)
   rtc->ops->set_time();
   					rtc_update_irq_enable(rtc, 0);
   rtc_update_irq_enable(rtc, 1);

Fix it by guaranteeing that reading uie timer state, setting rtc time
and enabling uie timer within a critical section.

Fixes: 7e7c005b4b1f ("rtc: disable uie before setting time and enable after")
Signed-off-by: Yu Liao <liaoyu15@huawei.com>
---
 drivers/rtc/interface.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
index bc55dd31bece..00a6173d8895 100644
--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -139,21 +139,21 @@ int rtc_set_time(struct rtc_device *rtc, struct rtc_time *tm)
 
 	rtc_subtract_offset(rtc, tm);
 
+	err = mutex_lock_interruptible(&rtc->ops_lock);
+	if (err)
+		return err;
+
 #ifdef CONFIG_RTC_INTF_DEV_UIE_EMUL
 	uie = rtc->uie_rtctimer.enabled || rtc->uie_irq_active;
 #else
 	uie = rtc->uie_rtctimer.enabled;
 #endif
 	if (uie) {
-		err = rtc_update_irq_enable(rtc, 0);
+		err = __rtc_update_irq_enable(rtc, 0);
 		if (err)
 			return err;
 	}
 
-	err = mutex_lock_interruptible(&rtc->ops_lock);
-	if (err)
-		return err;
-
 	if (!rtc->ops)
 		err = -ENODEV;
 	else if (rtc->ops->set_time)
@@ -162,15 +162,15 @@ int rtc_set_time(struct rtc_device *rtc, struct rtc_time *tm)
 		err = -EINVAL;
 
 	pm_stay_awake(rtc->dev.parent);
-	mutex_unlock(&rtc->ops_lock);
 	/* A timer might have just expired */
 	schedule_work(&rtc->irqwork);
 
 	if (uie) {
-		err = rtc_update_irq_enable(rtc, 1);
+		err = __rtc_update_irq_enable(rtc, 1);
 		if (err)
 			return err;
 	}
+	mutex_unlock(&rtc->ops_lock);
 
 	trace_rtc_set_time(rtc_tm_to_time64(tm), err);
 	return err;
-- 
2.25.1