From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dy1-f174.google.com (mail-dy1-f174.google.com [74.125.82.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C4F0D39903E for ; Thu, 16 Apr 2026 09:18:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.174 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776331095; cv=none; b=Ma9KiJmnm6g7at+5XF7TjKJr2fBWW0lu/+XXRAZtMl9OWx/l6SwYf9jhe8Jo1s2KW9O8qCBWBNlZ/qxobebTJqGb5BL6Lb2BhCmdwstqTSS2So6AROtI/ZN8ijy8sSgJ5yUrro/U769oeneRAl2ImCV8KlAL7Kk5l/8mHNtbV8U= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776331095; c=relaxed/simple; bh=d+1X7Njz9igX3gmwKo4zciVCRBP1oyl0oYxKxhWhBqo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=YzSp05o2gXVhnoGUmhFASWm+HTZyskhl/1ue+hsAB4kfdxnkogbDkmcwt2Du2XvNeqeLy4LTeFSAL+oa45jxut6wgSXARHjVke/HFgEyDFfbd0z43jocdHBg0T6u/MIla0s65gLDXKu1RFfZYj/hCTXa0x7NCoOuJUyl7IDIsLM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=i5kKjaxN; arc=none smtp.client-ip=74.125.82.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="i5kKjaxN" Received: by mail-dy1-f174.google.com with SMTP id 5a478bee46e88-2bd9a485bd6so15255465eec.1 for ; Thu, 16 Apr 2026 02:18:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776331093; x=1776935893; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=/RhanGM5dfIe9kmWnPIzxO7xokusaxBthdsG0vEBhbc=; b=i5kKjaxNrHwFMTJ1//KOvHAdAF9NqZ92Sd5B8ZEjNX8xsiDmKNs0ih4avbYsJYUvH0 dPvJELb6ia6etvXF1AyGisO78DGwyuqnhtsyp988ZWiO+XCoaPyKO0yEpQ81Jg9uwWDv Y/mSnuVuB1Am+HzS+PVt8qDu48ArO5VnyDDRn7keIFckaddurNRDmJfmkDMhiotw6YuY SnhycdmI/XVzVnR1bkTSbKu2hEmVvigDCS2c1vKuDoNzrZ2LgcGXbRvMYNJ1jRyCV9bE M9+kJlCY+rBI/ION4BCDQrX/KZ3PAXubuSfc983b3VDprcFW+iVHMZNsEBWkfjR6xWA6 /Byw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776331093; x=1776935893; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=/RhanGM5dfIe9kmWnPIzxO7xokusaxBthdsG0vEBhbc=; b=kO94/yls7wyxzWYd4APfkW2NFFV1gByFYXFHen2YVIVJE+gIaopEbdrLSx46hZErpL QDVeFhhsmjOJMZkZT3N1PS5/VqYNW4iNNe8j2GBLXmKEg76vGRcQgZSXPJLmCgC4NZ6E bM01g8Av6lxQ22p9ToFNfcfxDK5uRGmI5aSdad9nLE431e9StPzN9XtFmoIH8zCxPA8z 6chpH02MhtA9/vRdAViqVLl7MVdo9X1Kxt0YAiL0zZ66Mk4I9KdDMQ/sNH3exzIHMEYO oudkeDRrxKdmN00sXtwpaKL2n6MMbr6hhww11P6J2aWQknpZP/diKSoFF9fazljxjUiB XvKg== X-Forwarded-Encrypted: i=1; AFNElJ/U39qia7Evqw5YtGF+iWBGBTW2JGr0EGKK266vgCOW3ROyqpR3V07Z1oYNMA9+D9JSq4WljsWfSoFnb3s=@vger.kernel.org X-Gm-Message-State: AOJu0YwQT9Y/f3v8zb5bD8b1Wn0fhPK4I7hvoExiuEoo0x44JdwIVvHm O9zHx3/sMxvVaM735bY3XWxkUVuPDJb8OUCEZ9AbujlkU4NsCTfw8Lfy+7w8wQ== X-Gm-Gg: AeBDieuOAL7DyZvdj5sm4NC7foO+BTIXC5nyVYDyqAkduMKbs925TLlstGOw+yiEhXE 4D/lwN51UCixc+wxZKtugUAjKN1ptaM3Eb+vFc6QjU9rQNSzMD2BV8tndKhb3LNzqCsDZypqAPL V2+SxAFE0mVWEFTAVx+eLI2qznn14ryNpxwp/XE32ovAocEzu7S/0rzZdBI25jIRWSoYNAyanM8 p65zN4hpKUPiEn6jLeNI/JiDzH+mbk9HRGV5SdBQnIeUyzVQouiNWzKXeDWERNrpWeBeMIny60D hAXhDHUZAstPjhjq/M8saD0BxHYd5/OsCRZ5La0Cxwlnn8KBm4S544r+UgSPVhNWhAvuIv6A4bM zczwXqKL/x/G+41E7sJTX/ZZI4lu0ncoS0bcgy1M4gfTC54yrybIyl2d+7i/dO4bYOH68z9CW1u GIbVGakhr2omR7sSmFa69cCQl02jTh1Szkijto8em5cwaTnASjLndXEEJCK/3g+ku6EH1y0bm2a T2QHHZc/TyzhR5r7DWSWKqCxWCm+ti+Emn9AXvKR+ylklvkFvDFu+ns3+ARetVxQ8Ob8gDt7Zb5 QkaC3ksPmOV26bFZDojcLC4= X-Received: by 2002:a05:7300:e60c:b0:2e2:4979:eba with SMTP id 5a478bee46e88-2e249792b69mr232897eec.7.1776331092420; Thu, 16 Apr 2026 02:18:12 -0700 (PDT) Received: from 2045L.localdomain (49.sub-75-226-46.myvzw.com. [75.226.46.49]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-2de8eb8482asm6591216eec.15.2026.04.16.02.18.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 16 Apr 2026 02:18:12 -0700 (PDT) From: Gui-Dong Han To: Guenter Roeck Cc: linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org, baijiaju1990@gmail.com, Gui-Dong Han Subject: [PATCH 2/3] hwmon: (adm1031) Hold lock while reading cached data Date: Thu, 16 Apr 2026 17:17:53 +0800 Message-ID: <20260416091754.310-2-hanguidong02@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260416091754.310-1-hanguidong02@gmail.com> References: <20260416091754.310-1-hanguidong02@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The functions fan_show(), fan_min_show(), and temp_show() read shared cached values multiple times without holding data->update_lock. fan_auto_channel_store() also reads data->conf1 before taking the lock. Those cached values can change in adm1031_update_device(), resulting in inconsistent snapshots and TOCTOU races. Hold data->update_lock across those reads so that the cached values stay stable while the results are calculated. Check the remaining functions in the driver as well. Keep them unchanged because they either do not access shared cached values multiple times or already do so under lock. Link: https://lore.kernel.org/linux-hwmon/CALbr=LYJ_ehtp53HXEVkSpYoub+XYSTU8Rg=o1xxMJ8=5z8B-g@mail.gmail.com/ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Gui-Dong Han --- While learning the hwmon driver code, I found a few more potential TOCTOU problems in drivers still using the older non-_with_info() APIs. Fix them. --- drivers/hwmon/adm1031.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/drivers/hwmon/adm1031.c b/drivers/hwmon/adm1031.c index 0551f815233d..887fba9ea149 100644 --- a/drivers/hwmon/adm1031.c +++ b/drivers/hwmon/adm1031.c @@ -350,9 +350,8 @@ fan_auto_channel_store(struct device *dev, struct device_attribute *attr, if (ret) return ret; - old_fan_mode = data->conf1; - mutex_lock(&data->update_lock); + old_fan_mode = data->conf1; ret = get_fan_auto_nearest(data, nr, val, data->conf1); if (ret < 0) { @@ -568,8 +567,10 @@ static ssize_t fan_show(struct device *dev, struct device_attribute *attr, struct adm1031_data *data = adm1031_update_device(dev); int value; + mutex_lock(&data->update_lock); value = trust_fan_readings(data, nr) ? fan_from_reg(data->fan[nr], FAN_DIV_FROM_REG(data->fan_div[nr])) : 0; + mutex_unlock(&data->update_lock); return sprintf(buf, "%d\n", value); } @@ -585,9 +586,13 @@ static ssize_t fan_min_show(struct device *dev, struct device_attribute *attr, { int nr = to_sensor_dev_attr(attr)->index; struct adm1031_data *data = adm1031_update_device(dev); - return sprintf(buf, "%d\n", - fan_from_reg(data->fan_min[nr], - FAN_DIV_FROM_REG(data->fan_div[nr]))); + int value; + + mutex_lock(&data->update_lock); + value = fan_from_reg(data->fan_min[nr], + FAN_DIV_FROM_REG(data->fan_div[nr])); + mutex_unlock(&data->update_lock); + return sprintf(buf, "%d\n", value); } static ssize_t fan_min_store(struct device *dev, struct device_attribute *attr, const char *buf, @@ -677,10 +682,15 @@ static ssize_t temp_show(struct device *dev, struct device_attribute *attr, int nr = to_sensor_dev_attr(attr)->index; struct adm1031_data *data = adm1031_update_device(dev); int ext; + int temp; + + mutex_lock(&data->update_lock); ext = nr == 0 ? ((data->ext_temp[nr] >> 6) & 0x3) * 2 : (((data->ext_temp[nr] >> ((nr - 1) * 3)) & 7)); - return sprintf(buf, "%d\n", TEMP_FROM_REG_EXT(data->temp[nr], ext)); + temp = TEMP_FROM_REG_EXT(data->temp[nr], ext); + mutex_unlock(&data->update_lock); + return sprintf(buf, "%d\n", temp); } static ssize_t temp_offset_show(struct device *dev, struct device_attribute *attr, char *buf) -- 2.43.0