Skip to content

Commit 9eb4fb9

Browse files
2045castorgroeck
authored andcommitted
hwmon: (adm1029) Add locking to avoid TOCTOU
The function fan_show checks shared data for zero or invalid values before using it as a divisor. These accesses are currently lockless. If the data changes to zero between the check and the division, it causes a divide-by-zero error. Explicitly acquire the update lock around these checks and calculations to ensure the data remains stable, preventing Time-of-Check to Time-of-Use (TOCTOU) race conditions. Link: https://lore.kernel.org/all/CALbr=LYJ_ehtp53HXEVkSpYoub+XYSTU8Rg=o1xxMJ8=5z8B-g@mail.gmail.com/ Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com> Link: https://lore.kernel.org/r/20251126114047.10039-1-hanguidong02@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
1 parent be89cf7 commit 9eb4fb9

1 file changed

Lines changed: 3 additions & 0 deletions

File tree

drivers/hwmon/adm1029.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,14 +171,17 @@ fan_show(struct device *dev, struct device_attribute *devattr, char *buf)
171171
struct adm1029_data *data = adm1029_update_device(dev);
172172
u16 val;
173173

174+
mutex_lock(&data->update_lock);
174175
if (data->fan[attr->index] == 0 ||
175176
(data->fan_div[attr->index] & 0xC0) == 0 ||
176177
data->fan[attr->index] == 255) {
178+
mutex_unlock(&data->update_lock);
177179
return sprintf(buf, "0\n");
178180
}
179181

180182
val = 1880 * 120 / DIV_FROM_REG(data->fan_div[attr->index])
181183
/ data->fan[attr->index];
184+
mutex_unlock(&data->update_lock);
182185
return sprintf(buf, "%d\n", val);
183186
}
184187

0 commit comments

Comments
 (0)