Skip to content

Commit 4faaa77

Browse files
2045castorgroeck
authored andcommitted
hwmon: (emc2103) Add locking to avoid TOCTOU
The functions fan1_input_show and fan1_target_show check shared data for zero before using it as a divisor. These accesses are currently lockless. If the data changes to zero between the check and the division, it causes a divide-by-zero error. Explicitly acquire the update lock around these checks and calculations to ensure the data remains stable, preventing Time-of-Check to Time-of-Use (TOCTOU) race conditions. Link: https://lore.kernel.org/all/CALbr=LYJ_ehtp53HXEVkSpYoub+XYSTU8Rg=o1xxMJ8=5z8B-g@mail.gmail.com/ Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com> Link: https://lore.kernel.org/r/20251124165508.4667-1-hanguidong02@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
1 parent edbce49 commit 4faaa77

1 file changed

Lines changed: 4 additions & 0 deletions

File tree

drivers/hwmon/emc2103.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -277,8 +277,10 @@ fan1_input_show(struct device *dev, struct device_attribute *da, char *buf)
277277
{
278278
struct emc2103_data *data = emc2103_update_device(dev);
279279
int rpm = 0;
280+
mutex_lock(&data->update_lock);
280281
if (data->fan_tach != 0)
281282
rpm = (FAN_RPM_FACTOR * data->fan_multiplier) / data->fan_tach;
283+
mutex_unlock(&data->update_lock);
282284
return sprintf(buf, "%d\n", rpm);
283285
}
284286

@@ -363,10 +365,12 @@ fan1_target_show(struct device *dev, struct device_attribute *da, char *buf)
363365
struct emc2103_data *data = emc2103_update_device(dev);
364366
int rpm = 0;
365367

368+
mutex_lock(&data->update_lock);
366369
/* high byte of 0xff indicates disabled so return 0 */
367370
if ((data->fan_target != 0) && ((data->fan_target & 0x1fe0) != 0x1fe0))
368371
rpm = (FAN_RPM_FACTOR * data->fan_multiplier)
369372
/ data->fan_target;
373+
mutex_unlock(&data->update_lock);
370374

371375
return sprintf(buf, "%d\n", rpm);
372376
}

0 commit comments

Comments
 (0)