| Message ID | 20241003-iio-read-avail-release-v1-6-c70cc7d9c2e0@gmail.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | iio: fix possible race condition during access of available info lists | expand |
On Thu, 03 Oct 2024 19:34:11 +0200 Matteo Martelli <matteomartelli3@gmail.com> wrote: > The iio_read_avail_channel_raw() inkern interface now allocates a copy > of the available info buffer that must be freed after use. To do so, > free the buffer in the consumers read_avail_relese_resource callback. release Otherwise fine. J > > Signed-off-by: Matteo Martelli <matteomartelli3@gmail.com> > --- > drivers/iio/afe/iio-rescale.c | 8 ++++++++ > drivers/iio/dac/dpot-dac.c | 8 ++++++++ > drivers/iio/multiplexer/iio-mux.c | 8 ++++++++ > 3 files changed, 24 insertions(+) > > diff --git a/drivers/iio/afe/iio-rescale.c b/drivers/iio/afe/iio-rescale.c > index 56e5913ab82d1c045c9ca27012008a4495502cbf..78bb86c291706748b4072a484532ad20c415ff9f 100644 > --- a/drivers/iio/afe/iio-rescale.c > +++ b/drivers/iio/afe/iio-rescale.c > @@ -249,9 +249,17 @@ static int rescale_read_avail(struct iio_dev *indio_dev, > } > } > > +static void rescale_read_avail_release_res(struct iio_dev *indio_dev, > + struct iio_chan_spec const *chan, > + const int *vals, long mask) > +{ > + kfree(vals); > +} > + > static const struct iio_info rescale_info = { > .read_raw = rescale_read_raw, > .read_avail = rescale_read_avail, > + .read_avail_release_resource = rescale_read_avail_release_res, > }; > > static ssize_t rescale_read_ext_info(struct iio_dev *indio_dev, > diff --git a/drivers/iio/dac/dpot-dac.c b/drivers/iio/dac/dpot-dac.c > index 7332064d0852d979620f90066fb027f6f68f8c95..beec76247acb5170b81058d28a71ed17c831c905 100644 > --- a/drivers/iio/dac/dpot-dac.c > +++ b/drivers/iio/dac/dpot-dac.c > @@ -108,6 +108,13 @@ static int dpot_dac_read_avail(struct iio_dev *indio_dev, > return -EINVAL; > } > > +static void dpot_dac_read_avail_release_res(struct iio_dev *indio_dev, > + struct iio_chan_spec const *chan, > + const int *vals, long mask) > +{ > + kfree(vals); > +} > + > static int dpot_dac_write_raw(struct iio_dev *indio_dev, > struct iio_chan_spec const *chan, > int val, int val2, long mask) > @@ -125,6 +132,7 @@ static int dpot_dac_write_raw(struct iio_dev *indio_dev, > static const struct iio_info dpot_dac_info = { > .read_raw = dpot_dac_read_raw, > .read_avail = dpot_dac_read_avail, > + .read_avail_release_resource = dpot_dac_read_avail_release_res, > .write_raw = dpot_dac_write_raw, > }; > > diff --git a/drivers/iio/multiplexer/iio-mux.c b/drivers/iio/multiplexer/iio-mux.c > index 2953403bef53bbe47a97a8ab1c475ed88d7f86d2..31345437784b01c5d6f8ea70263f4c2574388e7a 100644 > --- a/drivers/iio/multiplexer/iio-mux.c > +++ b/drivers/iio/multiplexer/iio-mux.c > @@ -142,6 +142,13 @@ static int mux_read_avail(struct iio_dev *indio_dev, > return ret; > } > > +static void mux_read_avail_release_res(struct iio_dev *indio_dev, > + struct iio_chan_spec const *chan, > + const int *vals, long mask) > +{ > + kfree(vals); > +} > + > static int mux_write_raw(struct iio_dev *indio_dev, > struct iio_chan_spec const *chan, > int val, int val2, long mask) > @@ -171,6 +178,7 @@ static int mux_write_raw(struct iio_dev *indio_dev, > static const struct iio_info mux_info = { > .read_raw = mux_read_raw, > .read_avail = mux_read_avail, > + .read_avail_release_resource = mux_read_avail_release_res, > .write_raw = mux_write_raw, > }; > >
diff --git a/drivers/iio/afe/iio-rescale.c b/drivers/iio/afe/iio-rescale.c index 56e5913ab82d1c045c9ca27012008a4495502cbf..78bb86c291706748b4072a484532ad20c415ff9f 100644 --- a/drivers/iio/afe/iio-rescale.c +++ b/drivers/iio/afe/iio-rescale.c @@ -249,9 +249,17 @@ static int rescale_read_avail(struct iio_dev *indio_dev, } } +static void rescale_read_avail_release_res(struct iio_dev *indio_dev, + struct iio_chan_spec const *chan, + const int *vals, long mask) +{ + kfree(vals); +} + static const struct iio_info rescale_info = { .read_raw = rescale_read_raw, .read_avail = rescale_read_avail, + .read_avail_release_resource = rescale_read_avail_release_res, }; static ssize_t rescale_read_ext_info(struct iio_dev *indio_dev, diff --git a/drivers/iio/dac/dpot-dac.c b/drivers/iio/dac/dpot-dac.c index 7332064d0852d979620f90066fb027f6f68f8c95..beec76247acb5170b81058d28a71ed17c831c905 100644 --- a/drivers/iio/dac/dpot-dac.c +++ b/drivers/iio/dac/dpot-dac.c @@ -108,6 +108,13 @@ static int dpot_dac_read_avail(struct iio_dev *indio_dev, return -EINVAL; } +static void dpot_dac_read_avail_release_res(struct iio_dev *indio_dev, + struct iio_chan_spec const *chan, + const int *vals, long mask) +{ + kfree(vals); +} + static int dpot_dac_write_raw(struct iio_dev *indio_dev, struct iio_chan_spec const *chan, int val, int val2, long mask) @@ -125,6 +132,7 @@ static int dpot_dac_write_raw(struct iio_dev *indio_dev, static const struct iio_info dpot_dac_info = { .read_raw = dpot_dac_read_raw, .read_avail = dpot_dac_read_avail, + .read_avail_release_resource = dpot_dac_read_avail_release_res, .write_raw = dpot_dac_write_raw, }; diff --git a/drivers/iio/multiplexer/iio-mux.c b/drivers/iio/multiplexer/iio-mux.c index 2953403bef53bbe47a97a8ab1c475ed88d7f86d2..31345437784b01c5d6f8ea70263f4c2574388e7a 100644 --- a/drivers/iio/multiplexer/iio-mux.c +++ b/drivers/iio/multiplexer/iio-mux.c @@ -142,6 +142,13 @@ static int mux_read_avail(struct iio_dev *indio_dev, return ret; } +static void mux_read_avail_release_res(struct iio_dev *indio_dev, + struct iio_chan_spec const *chan, + const int *vals, long mask) +{ + kfree(vals); +} + static int mux_write_raw(struct iio_dev *indio_dev, struct iio_chan_spec const *chan, int val, int val2, long mask) @@ -171,6 +178,7 @@ static int mux_write_raw(struct iio_dev *indio_dev, static const struct iio_info mux_info = { .read_raw = mux_read_raw, .read_avail = mux_read_avail, + .read_avail_release_resource = mux_read_avail_release_res, .write_raw = mux_write_raw, };
The iio_read_avail_channel_raw() inkern interface now allocates a copy of the available info buffer that must be freed after use. To do so, free the buffer in the consumers read_avail_relese_resource callback. Signed-off-by: Matteo Martelli <matteomartelli3@gmail.com> --- drivers/iio/afe/iio-rescale.c | 8 ++++++++ drivers/iio/dac/dpot-dac.c | 8 ++++++++ drivers/iio/multiplexer/iio-mux.c | 8 ++++++++ 3 files changed, 24 insertions(+)