Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Tue, 18 Apr 2023 06:12:43 -0400
From:   William Breathitt Gray <william.gray@linaro.org>
To:     Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc:     linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org,
        Jonathan Cameron <jic23@kernel.org>, stable@vger.kernel.org
Subject: Re: [RESEND PATCH 5.15 v3 5/5] counter: 104-quad-8: Fix race
 condition between FLAG and CNTR reads
Message-ID: <ZD5tG45rXLemtkrX@fedora>
References: <20230411155220.9754-1-william.gray@linaro.org>
 <20230411155220.9754-5-william.gray@linaro.org>
 <ZD1MZO3KpRmuzy42@fedora>
 <2023041849-nursing-cling-8729@gregkh>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
        protocol="application/pgp-signature"; boundary="GjX2gYdKDPhjx3jN"
Content-Disposition: inline
In-Reply-To: <2023041849-nursing-cling-8729@gregkh>
Precedence: bulk


--GjX2gYdKDPhjx3jN
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Apr 18, 2023 at 11:41:29AM +0200, Greg Kroah-Hartman wrote:
> On Mon, Apr 17, 2023 at 09:40:52AM -0400, William Breathitt Gray wrote:
> > On Tue, Apr 11, 2023 at 11:52:20AM -0400, William Breathitt Gray wrote:
> > > commit 4aa3b75c74603c3374877d5fd18ad9cc3a9a62ed upstream.
> > >=20
> > > The Counter (CNTR) register is 24 bits wide, but we can have an
> > > effective 25-bit count value by setting bit 24 to the XOR of the Borr=
ow
> > > flag and Carry flag. The flags can be read from the FLAG register, bu=
t a
> > > race condition exists: the Borrow flag and Carry flag are instantaneo=
us
> > > and could change by the time the count value is read from the CNTR
> > > register.
> > >=20
> > > Since the race condition could result in an incorrect 25-bit count
> > > value, remove support for 25-bit count values from this driver.
> > >=20
> > > Fixes: 28e5d3bb0325 ("iio: 104-quad-8: Add IIO support for the ACCES =
104-QUAD-8")
> > > Cc: <stable@vger.kernel.org> # 5.15.x
> > > Signed-off-by: William Breathitt Gray <william.gray@linaro.org>
> > > ---
> > >  drivers/counter/104-quad-8.c | 18 +++---------------
> > >  1 file changed, 3 insertions(+), 15 deletions(-)
> > >=20
> > > diff --git a/drivers/counter/104-quad-8.c b/drivers/counter/104-quad-=
8.c
> > > index 0caa60537b..643aae0c9f 100644
> > > --- a/drivers/counter/104-quad-8.c
> > > +++ b/drivers/counter/104-quad-8.c
> > > @@ -61,10 +61,6 @@ struct quad8 {
> > >  #define QUAD8_REG_CHAN_OP 0x11
> > >  #define QUAD8_REG_INDEX_INPUT_LEVELS 0x16
> > >  #define QUAD8_DIFF_ENCODER_CABLE_STATUS 0x17
> > > -/* Borrow Toggle flip-flop */
> > > -#define QUAD8_FLAG_BT BIT(0)
> > > -/* Carry Toggle flip-flop */
> > > -#define QUAD8_FLAG_CT BIT(1)
> > >  /* Error flag */
> > >  #define QUAD8_FLAG_E BIT(4)
> > >  /* Up/Down flag */
> > > @@ -121,17 +117,9 @@ static int quad8_count_read(struct counter_devic=
e *counter,
> > >  {
> > >  	struct quad8 *const priv =3D counter->priv;
> > >  	const int base_offset =3D priv->base + 2 * count->id;
> > > -	unsigned int flags;
> > > -	unsigned int borrow;
> > > -	unsigned int carry;
> > >  	int i;
> > > =20
> > > -	flags =3D inb(base_offset + 1);
> > > -	borrow =3D flags & QUAD8_FLAG_BT;
> > > -	carry =3D !!(flags & QUAD8_FLAG_CT);
> > > -
> > > -	/* Borrow XOR Carry effectively doubles count range */
> > > -	*val =3D (unsigned long)(borrow ^ carry) << 24;
> > > +	*val =3D 0;
> > > =20
> > >  	mutex_lock(&priv->lock);
> > > =20
> > > @@ -699,8 +687,8 @@ static ssize_t quad8_count_ceiling_read(struct co=
unter_device *counter,
> > > =20
> > >  	mutex_unlock(&priv->lock);
> > > =20
> > > -	/* By default 0x1FFFFFF (25 bits unsigned) is maximum count */
> > > -	return sprintf(buf, "33554431\n");
> > > +	/* By default 0xFFFFFF (24 bits unsigned) is maximum count */
> > > +	return sprintf(buf, "16777215\n");
> > >  }
> > > =20
> > >  static ssize_t quad8_count_ceiling_write(struct counter_device *coun=
ter,
> > >=20
> > > base-commit: d86dfc4d95cd218246b10ca7adf22c8626547599
> > > --=20
> > > 2.39.2
> >=20
> > Greg,
> >=20
> > This patch will no longer apply to 5.15.x when the "counter: Internalize
> > sysfs interface code" patch in the stable-queue tree is merged [0].
> > However, I believe the 6.1 backport [1] will apply instead at that
> > point. What is the best way to handle this situation? Should I resend
> > the 6.1 backport with the stable list Cc tag adjusted for 5.15.x, or are
> > you able to apply the 6.1 backport patch directly to the 5.15.x tree?
>=20
> The 6.1.y backport didn't apply either :(
>=20
> Can you resend all of these rebased against the next round of stable
> releases when they are released later this week?
>=20
> thanks,
>=20
> greg k-h

Sure, I'll rebase and resend these after the next round of stable
releases is available.

William Breathitt Gray

--GjX2gYdKDPhjx3jN
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQSNN83d4NIlKPjon7a1SFbKvhIjKwUCZD5tGwAKCRC1SFbKvhIj
K5nIAQD0P+faGjAKpFGYha1jg2kvB+Vw8HGrbzC9gQ3NUv+ZqQEA4/PRFI//Kzjq
UalBMdVBq8Y+BSd2RlOInpa0i9oBsgc=
=u9fk
-----END PGP SIGNATURE-----

--GjX2gYdKDPhjx3jN--