Messages in this thread | | | From | Shuah Khan <> | Subject | drivers/char/ppdev - | Date | Fri, 2 Oct 2020 15:01:33 -0600 |
| |
Hi Sudip,
While looking at atomic_t usages and noticed a few potential problem the way struct pp_struct: atomic_t irqc field
- There is inconsistencies the lock hold in this driver.
pp_do_mutex is help before pp_do_ioctl() is called. static int pp_do_ioctl() ....
pp_do_mutex case PPCLRIRQ: ret = atomic_read(&pp->irqc); if (copy_to_user(argp, &ret, sizeof(ret))) return -EFAULT; atomic_sub(ret, &pp->irqc); return 0;
This path seems safe as far as atomic_t overflow is concerned.
However, pp_poll(), pp_irq(), and pp_open() etc. don't hold lock while pp_do_ioctl() path does.
Something to look into to see if this is safe. I see this comment for pp_poll() /* No kernel lock held - fine */
Anyway, please take a look and see if this is indeed a problem.
thanks, -- Shuah
| |