lkml.org 
[lkml]   [2022]   [Oct]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[RFC PATCH 2/2] rtc: fix race condition in rtc_set_time()
Date
Commit 7e7c005b4b1f ("rtc: disable uie before setting time and enable
after") was introduced to solve problem that rtc_timer_do_work will loop
for a while, when setting the time in the future with the uie timer
enabled. But reading uie timer state and setting rtc time are not in
a critical section, a race condition may occur in rtc_set_time which
has two issues:

1) In the above scenario, rtc_timer_do_work may still loop for a while.
For example consider the following sequence:

CPU0 CPU1
---- ----
ioctl(RTC_SET_TIME) ioctl(RTC_UIE_ON)
uie = rtc->uie_rtctimer.enabled;
[ assume uie is 0 ]
if (uie)
rtc_update_irq_enable(rtc, 0);

rtc_update_irq_enable(rtc, 1);
[ uie is enabled ]
rtc->ops->set_time();
[ set rtc time in the future ]

2) A thread try to turn off uie, however rtc_settime called by another
thread turns on uie when they run in parallel. Consider the following
sequence:

CPU0 CPU1
---- ----
ioctl(RTC_SET_TIME) ioctl(RTC_UIE_OFF)
rtc->ops->set_time();
rtc_update_irq_enable(rtc, 0);
rtc_update_irq_enable(rtc, 1);

Fix it by guaranteeing that reading uie timer state, setting rtc time
and enabling uie timer within a critical section.

Fixes: 7e7c005b4b1f ("rtc: disable uie before setting time and enable after")
Signed-off-by: Yu Liao <liaoyu15@huawei.com>
---
drivers/rtc/interface.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
index bc55dd31bece..00a6173d8895 100644
--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -139,21 +139,21 @@ int rtc_set_time(struct rtc_device *rtc, struct rtc_time *tm)

rtc_subtract_offset(rtc, tm);

+ err = mutex_lock_interruptible(&rtc->ops_lock);
+ if (err)
+ return err;
+
#ifdef CONFIG_RTC_INTF_DEV_UIE_EMUL
uie = rtc->uie_rtctimer.enabled || rtc->uie_irq_active;
#else
uie = rtc->uie_rtctimer.enabled;
#endif
if (uie) {
- err = rtc_update_irq_enable(rtc, 0);
+ err = __rtc_update_irq_enable(rtc, 0);
if (err)
return err;
}

- err = mutex_lock_interruptible(&rtc->ops_lock);
- if (err)
- return err;
-
if (!rtc->ops)
err = -ENODEV;
else if (rtc->ops->set_time)
@@ -162,15 +162,15 @@ int rtc_set_time(struct rtc_device *rtc, struct rtc_time *tm)
err = -EINVAL;

pm_stay_awake(rtc->dev.parent);
- mutex_unlock(&rtc->ops_lock);
/* A timer might have just expired */
schedule_work(&rtc->irqwork);

if (uie) {
- err = rtc_update_irq_enable(rtc, 1);
+ err = __rtc_update_irq_enable(rtc, 1);
if (err)
return err;
}
+ mutex_unlock(&rtc->ops_lock);

trace_rtc_set_time(rtc_tm_to_time64(tm), err);
return err;
--
2.25.1
\
 
 \ /
  Last update: 2022-10-26 05:36    [W:0.040 / U:0.108 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site