github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 12:44:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

hwmon: (applesmc) Fix lockless cache validation data race

Browse Source 
In applesmc_get_entry_by_index(), the cache->valid flag is checked
locklessly, but setting it to true lacks memory barriers. This can lead to
a data race (TOCTOU) where another thread sees cache->valid as true
before the actual cache contents (cache->key, cache->len, cache->type, etc.)
are fully committed and visible to that CPU, potentially causing it to read
uninitialized data and send incorrect keys to the Apple SMC hardware.

Introduce memory barriers (smp_load_acquire and smp_store_release) with
explanatory comments to ensure cache synchronization is thread-safe and
fully visible across all CPUs.

Signed-off-by: Shih-Yuan Lee <fourdollars@debian.org>
Link: https://lore.kernel.org/r/20260711093323.14529-3-fourdollars@debian.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
This commit is contained in:
Shih-Yuan Lee 2026-07-11 17:33:22 +08:00 committed by Guenter Roeck
parent d33baed3fe
commit 5a151274c1
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/hwmon/applesmc.c
View File

@ -33,6 +33,7 @@
#include <linux/workqueue.h>
#include <linux/err.h>
#include <linux/bits.h>
#include <asm/barrier.h>
/* data port used by Apple SMC */
#define APPLESMC_DATA_PORT 0x300
@ -373,7 +374,8 @@ static const struct applesmc_entry *applesmc_get_entry_by_index(int index)
__be32 be;
int ret = 0;
if (cache->valid)
/* Pairs with smp_store_release() to ensure cache contents are visible */
if (smp_load_acquire(&cache->valid))
return cache;
mutex_lock(&smcreg.mutex);
@ -392,7 +394,8 @@ static const struct applesmc_entry *applesmc_get_entry_by_index(int index)
cache->len = info[0];
memcpy(cache->type, &info[1], 4);
cache->flags = info[5];
cache->valid = true;
/* Pairs with smp_load_acquire() to commit cache contents before setting valid */
smp_store_release(&cache->valid, true);
out:
mutex_unlock(&smcreg.mutex);