[PATCH] tty: serial: owl: Fix data race in owl_uart_remove

Suppose the driver is registered and a UART port is added. Once an
application opens the port, owl_uart_startup is called which registers
the interrupt handler owl_uart_irq.

We could have the following race condition:

When device is removed, owl_uart_remove is called, which calls
uart_remove_one_port, which calls owl_uart_release_port, which writes
NULL to port->membase. At this point parallely, an interrupt could be
handled by owl_uart_irq which reads port->membase.

This is because it is possible to remove device without closing a port.
Thus, we need to check it and call owl_uart_shutdown in owl_uart_remove.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Saubhik Mukherjee <redacted>
---
 drivers/tty/serial/owl-uart.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/owl-uart.c b/drivers/tty/serial/owl-uart.c
index 91f1eb0058d7..ac4e3aae2719 100644
--- a/drivers/tty/serial/owl-uart.c
+++ b/drivers/tty/serial/owl-uart.c

@@ -751,8 +751,15 @@ static int owl_uart_probe(struct platform_device *pdev)
 static int owl_uart_remove(struct platform_device *pdev)
 {
 	struct owl_uart_port *owl_port = platform_get_drvdata(pdev);
+	struct uart_port *port = &owl_port->port;
 
-	uart_remove_one_port(&owl_uart_driver, &owl_port->port);
+	/* It is possible to release device without closing a port.
+	 * Thus, need to check it and call shutdown.
+	 */
+	if (owl_uart_read(port, OWL_UART_CTL) & OWL_UART_CTL_EN)
+		owl_uart_shutdown(port);
+
+	uart_remove_one_port(&owl_uart_driver, port);
 	owl_uart_ports[pdev->id] = NULL;
 	clk_disable_unprepare(owl_port->clk);
 

-- 
2.30.2

On Thu, Jun 17, 2021 at 04:34:43PM +0530, Saubhik Mukherjee wrote:

How is this read determining if the device is here or not?  And what
happens if the state change happens right _after_ the check?

Also, your comment style is for networking, not the rest of the kernel
:)

thanks,

greg k-h

On 6/17/21 4:52 PM, Greg KH wrote:

On Thu, Jun 17, 2021 at 04:34:43PM +0530, Saubhik Mukherjee wrote:

quoted

Suppose the driver is registered and a UART port is added. Once an
application opens the port, owl_uart_startup is called which registers
the interrupt handler owl_uart_irq.

We could have the following race condition:

When device is removed, owl_uart_remove is called, which calls
uart_remove_one_port, which calls owl_uart_release_port, which writes
NULL to port->membase. At this point parallely, an interrupt could be
handled by owl_uart_irq which reads port->membase.

This is because it is possible to remove device without closing a port.
Thus, we need to check it and call owl_uart_shutdown in owl_uart_remove.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Saubhik Mukherjee <redacted>
---
  drivers/tty/serial/owl-uart.c | 9 ++++++++-
  1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/owl-uart.c b/drivers/tty/serial/owl-uart.c
index 91f1eb0058d7..ac4e3aae2719 100644
--- a/drivers/tty/serial/owl-uart.c
+++ b/drivers/tty/serial/owl-uart.c

@@ -751,8 +751,15 @@ static int owl_uart_probe(struct platform_device *pdev)
  static int owl_uart_remove(struct platform_device *pdev)
  {
  	struct owl_uart_port *owl_port = platform_get_drvdata(pdev);
+	struct uart_port *port = &owl_port->port;
  
-	uart_remove_one_port(&owl_uart_driver, &owl_port->port);
+	/* It is possible to release device without closing a port.
+	 * Thus, need to check it and call shutdown.
+	 */
+	if (owl_uart_read(port, OWL_UART_CTL) & OWL_UART_CTL_EN)
+		owl_uart_shutdown(port);

How is this read determining if the device is here or not?  And what
happens if the state change happens right _after_ the check?

Also, your comment style is for networking, not the rest of the kernel
:)

Thank you for your comments. OWL_UART_CTL_EN is set during startup and 
cleared during shutdown. It is not used anywhere else. So, it is used to 
determine if the port is opened.

To avoid issue due to state change right after check, the patch is 
updated. A global mutex is used to avoid race between owl_uart_startup 
and owl_uart_remove. The port opened check is done inside owl_uart_shutdown.

Signed-off-by: Saubhik Mukherjee <redacted>
---
  drivers/tty/serial/owl-uart.c | 27 ++++++++++++++++++++++-----
  1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/drivers/tty/serial/owl-uart.c b/drivers/tty/serial/owl-uart.c
index 91f1eb0058d7..7a17f4637ea2 100644
--- a/drivers/tty/serial/owl-uart.c
+++ b/drivers/tty/serial/owl-uart.c

@@ -68,6 +68,8 @@

  static struct uart_driver owl_uart_driver;

+static DEFINE_MUTEX(owl_uart_mutex);  /* race between startup & remove */
+
  struct owl_uart_info {
  	unsigned int tx_fifosize;
  };

@@ -283,13 +285,19 @@ static void owl_uart_shutdown(struct uart_port *port)
  	spin_lock_irqsave(&port->lock, flags);

  	val = owl_uart_read(port, OWL_UART_CTL);
-	val &= ~(OWL_UART_CTL_TXIE | OWL_UART_CTL_RXIE
-		| OWL_UART_CTL_TXDE | OWL_UART_CTL_RXDE | OWL_UART_CTL_EN);
-	owl_uart_write(port, val, OWL_UART_CTL);

-	spin_unlock_irqrestore(&port->lock, flags);
+	/* Check if port is opened */
+	if (val & OWL_UART_CTL_EN) {
+		val &= ~(OWL_UART_CTL_TXIE | OWL_UART_CTL_RXIE
+			| OWL_UART_CTL_TXDE | OWL_UART_CTL_RXDE | OWL_UART_CTL_EN);
+		owl_uart_write(port, val, OWL_UART_CTL);
+
+		spin_unlock_irqrestore(&port->lock, flags);

-	free_irq(port->irq, port);
+		free_irq(port->irq, port);
+	} else {
+		spin_unlock_irqrestore(&port->lock, flags);
+	}
  }

  static int owl_uart_startup(struct uart_port *port)

@@ -298,6 +306,8 @@ static int owl_uart_startup(struct uart_port *port)
  	unsigned long flags;
  	int ret;

+	mutex_lock(&owl_uart_mutex);
+
  	ret = request_irq(port->irq, owl_uart_irq, IRQF_TRIGGER_HIGH,
  			"owl-uart", port);
  	if (ret)

@@ -317,6 +327,7 @@ static int owl_uart_startup(struct uart_port *port)

  	spin_unlock_irqrestore(&port->lock, flags);

+	mutex_unlock(&owl_uart_mutex);
  	return 0;
  }

@@ -752,10 +763,16 @@ static int owl_uart_remove(struct platform_device 

*pdev)
  {
  	struct owl_uart_port *owl_port = platform_get_drvdata(pdev);

+	mutex_lock(&owl_uart_mutex);
+
+	/* Avoid removing port without closing */
+	owl_uart_shutdown(&owl_port->port);
+
  	uart_remove_one_port(&owl_uart_driver, &owl_port->port);
  	owl_uart_ports[pdev->id] = NULL;
  	clk_disable_unprepare(owl_port->clk);

+	mutex_unlock(&owl_uart_mutex);
  	return 0;
  }

-- 
2.30.2

On Wed, Jun 23, 2021 at 11:06:53AM +0530, Saubhik Mukherjee wrote:

On 6/17/21 4:52 PM, Greg KH wrote:

quoted

On Thu, Jun 17, 2021 at 04:34:43PM +0530, Saubhik Mukherjee wrote:

quoted

Suppose the driver is registered and a UART port is added. Once an
application opens the port, owl_uart_startup is called which registers
the interrupt handler owl_uart_irq.

We could have the following race condition:

When device is removed, owl_uart_remove is called, which calls
uart_remove_one_port, which calls owl_uart_release_port, which writes
NULL to port->membase. At this point parallely, an interrupt could be
handled by owl_uart_irq which reads port->membase.

This is because it is possible to remove device without closing a port.
Thus, we need to check it and call owl_uart_shutdown in owl_uart_remove.

No, this makes no sense at all. The port is deregistered and hung up by
uart_remove_one_port() (and the interrupt line is consequently disabled
by the driver) before it is released so this can never happen.

quoted

quoted

Found by Linux Driver Verification project (linuxtesting.org).

And you clearly did not test this, which you should mention.

Johan

On 6/23/21 12:46 PM, Johan Hovold wrote:

On Wed, Jun 23, 2021 at 11:06:53AM +0530, Saubhik Mukherjee wrote:

quoted

On 6/17/21 4:52 PM, Greg KH wrote:

quoted

On Thu, Jun 17, 2021 at 04:34:43PM +0530, Saubhik Mukherjee wrote:

quoted

Suppose the driver is registered and a UART port is added. Once an
application opens the port, owl_uart_startup is called which registers
the interrupt handler owl_uart_irq.

We could have the following race condition:

When device is removed, owl_uart_remove is called, which calls
uart_remove_one_port, which calls owl_uart_release_port, which writes
NULL to port->membase. At this point parallely, an interrupt could be
handled by owl_uart_irq which reads port->membase.

This is because it is possible to remove device without closing a port.
Thus, we need to check it and call owl_uart_shutdown in owl_uart_remove.

No, this makes no sense at all. The port is deregistered and hung up by
uart_remove_one_port() (and the interrupt line is consequently disabled
by the driver) before it is released so this can never happen.

Thanks for the reply. I am not sure I understand. I could not find any 
interrupt disabling in owl_uart_remove. Could you point out where/how is 
the interrupt line is disabled before releasing the port?

A related question question was asked in 
https://lore.kernel.org/linux-serial/YMcpBXd1vtipueQi@kroah.com/.

quoted

quoted

quoted

Found by Linux Driver Verification project (linuxtesting.org).

And you clearly did not test this, which you should mention.

This race warning was found by a static analysis tool. The code changes 
are untested.

On Thu, Jun 24, 2021 at 05:37:38PM +0530, Saubhik Mukherjee wrote:

On 6/23/21 12:46 PM, Johan Hovold wrote:

quoted

On Wed, Jun 23, 2021 at 11:06:53AM +0530, Saubhik Mukherjee wrote:

quoted

On 6/17/21 4:52 PM, Greg KH wrote:

quoted

On Thu, Jun 17, 2021 at 04:34:43PM +0530, Saubhik Mukherjee wrote:

quoted

Suppose the driver is registered and a UART port is added. Once an
application opens the port, owl_uart_startup is called which registers
the interrupt handler owl_uart_irq.

We could have the following race condition:

When device is removed, owl_uart_remove is called, which calls
uart_remove_one_port, which calls owl_uart_release_port, which writes
NULL to port->membase. At this point parallely, an interrupt could be
handled by owl_uart_irq which reads port->membase.

This is because it is possible to remove device without closing a port.
Thus, we need to check it and call owl_uart_shutdown in owl_uart_remove.

No, this makes no sense at all. The port is deregistered and hung up by
uart_remove_one_port() (and the interrupt line is consequently disabled
by the driver) before it is released so this can never happen.

Thanks for the reply. I am not sure I understand. I could not find any 
interrupt disabling in owl_uart_remove. Could you point out where/how is 
the interrupt line is disabled before releasing the port?

The interrupt line is disabled by owl_uart_shutdown(), which is called
when uart_remove_one_port() hangs up an open tty. And as I mentioned
this happens after deregistering the port (so no new opens) and before
releasing the port.

Johan

On 6/24/21 5:59 PM, Johan Hovold wrote:

On Thu, Jun 24, 2021 at 05:37:38PM +0530, Saubhik Mukherjee wrote:

quoted

On 6/23/21 12:46 PM, Johan Hovold wrote:

quoted

On Wed, Jun 23, 2021 at 11:06:53AM +0530, Saubhik Mukherjee wrote:

quoted

On 6/17/21 4:52 PM, Greg KH wrote:

quoted

On Thu, Jun 17, 2021 at 04:34:43PM +0530, Saubhik Mukherjee wrote:

quoted

Suppose the driver is registered and a UART port is added. Once an
application opens the port, owl_uart_startup is called which registers
the interrupt handler owl_uart_irq.

We could have the following race condition:

When device is removed, owl_uart_remove is called, which calls
uart_remove_one_port, which calls owl_uart_release_port, which writes
NULL to port->membase. At this point parallely, an interrupt could be
handled by owl_uart_irq which reads port->membase.

This is because it is possible to remove device without closing a port.
Thus, we need to check it and call owl_uart_shutdown in owl_uart_remove.

No, this makes no sense at all. The port is deregistered and hung up by
uart_remove_one_port() (and the interrupt line is consequently disabled
by the driver) before it is released so this can never happen.

Thanks for the reply. I am not sure I understand. I could not find any
interrupt disabling in owl_uart_remove. Could you point out where/how is
the interrupt line is disabled before releasing the port?

The interrupt line is disabled by owl_uart_shutdown(), which is called
when uart_remove_one_port() hangs up an open tty. And as I mentioned
this happens after deregistering the port (so no new opens) and before
releasing the port.

Johan

Thank you very much for the explanation. So, indeed shutdown is called 
before releasing port. There is no need for a patch.