diff options
| author | Gui-Dong Han <hanguidong02@gmail.com> | 2025-11-26 19:40:46 +0800 |
|---|---|---|
| committer | Guenter Roeck <linux@roeck-us.net> | 2025-11-26 07:48:31 -0800 |
| commit | 9eb4fb93069a889aae955c2fbf78f9eb34ac4562 (patch) | |
| tree | 4935c80985929527110f9f04d2847152f8697de3 | |
| parent | be89cf786d36f44d7765c572296fc9299afa428c (diff) | |
hwmon: (adm1029) Add locking to avoid TOCTOU
The function fan_show checks shared data for zero or invalid values
before using it as a divisor. These accesses are currently lockless. If
the data changes to zero between the check and the division, it causes a
divide-by-zero error.
Explicitly acquire the update lock around these checks and calculations
to ensure the data remains stable, preventing Time-of-Check to
Time-of-Use (TOCTOU) race conditions.
Link: https://lore.kernel.org/all/CALbr=LYJ_ehtp53HXEVkSpYoub+XYSTU8Rg=o1xxMJ8=5z8B-g@mail.gmail.com/
Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
Link: https://lore.kernel.org/r/20251126114047.10039-1-hanguidong02@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
| -rw-r--r-- | drivers/hwmon/adm1029.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/hwmon/adm1029.c b/drivers/hwmon/adm1029.c index 761c13092488..71eea8ae51b9 100644 --- a/drivers/hwmon/adm1029.c +++ b/drivers/hwmon/adm1029.c @@ -171,14 +171,17 @@ fan_show(struct device *dev, struct device_attribute *devattr, char *buf) struct adm1029_data *data = adm1029_update_device(dev); u16 val; + mutex_lock(&data->update_lock); if (data->fan[attr->index] == 0 || (data->fan_div[attr->index] & 0xC0) == 0 || data->fan[attr->index] == 255) { + mutex_unlock(&data->update_lock); return sprintf(buf, "0\n"); } val = 1880 * 120 / DIV_FROM_REG(data->fan_div[attr->index]) / data->fan[attr->index]; + mutex_unlock(&data->update_lock); return sprintf(buf, "%d\n", val); } |