Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

comedi: comedi_bond: Check for loops when bonding devices

The "comedi_bond" driver allows a composite COMEDI device to be built up
from the subdevices of other COMEDI devices, although it currently only
supports digital I/O subdevices. Although it checks that it is not
trying to bind to itself, it is possible to end up with a cycle of
"comedi_bond" devices bound to each other. For example:

1. Configure /dev/comedi0 to use some COMEDI hardware device with
digital I/O subdevices, but not a "comedi_bond" device.
2. Configure /dev/comedi1 as a "comedi_bond" device bound to
/dev/comedi0.
3. Unconfigure /dev/comedi0 and reconfigure it as a "comedi_bond" device
bound to /dev/comedi1.

Now we have /dev/comedi0 and /dev/comedi1 bound in a cycle. When an
operation is performed on the digital I/O subdevice of /dev/comedi0 for
example, it will try and perform the operation on /dev/comedi1, which
will try and perform the operation on /dev/comedi0. The task will end
up deadlocked trying to lock /dev/comedi0's mutex which it has already
locked.

I discovered that possibility while investigating fix sysbot crash
https://syzkaller.appspot.com/bug?extid=4a6138c17a47937dcea1 ("possible
deadlock in comedi_do_insn"), but I think that report may be a false
positive.

To avoid that, replace the calls to `comedi_open()` and `comedi_close()`
in "kcomedilib" with calls to `comedi_open_from()` and
`comedi_close_from()`. These take an extra parameter that indicates the
COMEDI minor device number from which the open or close is being
performed. `comedi_open_from()` will refuse to open the device if doing
so would result in a cycle. The cycle detection depends on the extra
parameter having the correct value for this device and also for existing
devices in the chain.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20251027153748.4569-3-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Ian Abbott and committed by
Greg Kroah-Hartman
2402f958 d1b3b9c7

+2 -2
+2 -2
drivers/comedi/drivers/comedi_bond.c
··· 205 205 snprintf(file, sizeof(file), "/dev/comedi%d", minor); 206 206 file[sizeof(file) - 1] = 0; 207 207 208 - d = comedi_open(file); 208 + d = comedi_open_from(file, dev->minor); 209 209 210 210 if (!d) { 211 211 dev_err(dev->class_dev, ··· 326 326 if (!bdev) 327 327 continue; 328 328 if (!test_and_set_bit(bdev->minor, devs_closed)) 329 - comedi_close(bdev->dev); 329 + comedi_close_from(bdev->dev, dev->minor); 330 330 kfree(bdev); 331 331 } 332 332 kfree(devpriv->devs);