From nobody Thu Sep 24 20:04:07 2026 Received: from mta-64-228.siemens.flowmailer.net (mta-64-228.siemens.flowmailer.net [185.136.64.228]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7101F48EC9E for ; Mon, 21 Sep 2026 09:33:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.136.64.228 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789983196; cv=none; b=WWPvJ9A2oeUL5ZKqgkt3CZ89dYWrcJE7zcJI34fIyJQ3cfxu1SJuxDQmJez6ttrRNmGo9rmBN+f80hXUcBrSWIM6aGTZOzbEt+/gP5q9nygwIGTiZiHWk1TAeQ058dMBYyMi5dcWiSU9yYWcSerExKCVI0giZ+ZLv9ES2NKXTRI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789983196; c=relaxed/simple; bh=WPJHYnrQrYYS/+gXuwPOGWMsKbPW/NqlsGM3UKpVqPw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hdcReyL6mfKmr3QR8y17tdATGYrXi8KRTvQdm2Eo3g7hgH1a5+DbtVy6H796/LydULCkgYV7GnmerWAY9VkmKb5Pn0zNR2mkzowTi2WVCKfKlfSovFPuknNBMHSJbqwUsv/x2MBAkcA2GYHPTJK5RTgeLRb2qxo9I9c1JQhF1W4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=siemens.com; spf=pass smtp.mailfrom=rts-flowmailer.siemens.com; dkim=pass (2048-bit key) header.d=siemens.com header.i=alexander.sverdlin@siemens.com header.b=sY7PgeOC; arc=none smtp.client-ip=185.136.64.228 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=siemens.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rts-flowmailer.siemens.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=siemens.com header.i=alexander.sverdlin@siemens.com header.b="sY7PgeOC" Received: by mta-64-228.siemens.flowmailer.net with ESMTPSA id 202609210932595549e0970b00020742 for ; Mon, 21 Sep 2026 11:32:59 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=alexander.sverdlin@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=L2tNSuNj50Qwkw6ouG81VT0DerK7MEmUivw5GyG01+M=; b=sY7PgeOCewMuZ6A416pnAewJFx+4t2xBzq2XBWMG+JTqHrBIBOnxued9E2s6mmAapDJTm5 sy0vPEjak8FJwog0sQN5RXKKwxAFLrj02bvo5HUzE84/0aYAiuoYmZmwdBv0byOd/lzN3Gss heFcdeke7oigQ0p1Br+JS+PDapyO1gn/9qGNpe188ObKSza83N0TtIzwE8fdSL+AZvyUyjsU i1sW9dKa/oqyhgioOE7TKiObXZNPuNszNktLwQuLtLdszzrxp4rtWFp5r9bLTFxAHBpuZ3Cf LUEQs5LytUpNl9CJO8zyqs1UuOdsk+rCuSj18IwBPFVE+nqlfe5AV9sg==; From: "A. Sverdlin" To: linux-leds@vger.kernel.org Cc: Alexander Sverdlin , Lee Jones , Pavel Machek , Andrew Lunn , "Mike Marciniszyn (Meta)" , Jakub Kicinski , Kees Cook , =?UTF-8?q?Marek=20Beh=C3=BAn?= , Christian Marangi , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2 1/4] leds: trigger: netdev: Put netdev on activate error path Date: Mon, 21 Sep 2026 11:32:43 +0200 Message-ID: <20260921093249.3481413-2-alexander.sverdlin@siemens.com> In-Reply-To: <20260921093249.3481413-1-alexander.sverdlin@siemens.com> References: <20260921093249.3481413-1-alexander.sverdlin@siemens.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-456497:519-21489:flowmailer Content-Type: text/plain; charset="utf-8" From: Alexander Sverdlin When hw control is active, set_device_name() takes a reference on the netdev via dev_get_by_name(). The register_netdevice_notifier() failure path frees trigger_data without dropping it, leaking the netdev. Cc: stable@vger.kernel.org Closes: https://lore.kernel.org/all/20260914140045.B8F4C1F000FF@smtp.kernel= .org/ Fixes: 0316cc5629d1 ("leds: trigger: netdev: init mode if hw control alread= y active") Signed-off-by: Alexander Sverdlin --- Changelog: v2: - new patch drivers/leds/trigger/ledtrig-netdev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/leds/trigger/ledtrig-netdev.c b/drivers/leds/trigger/l= edtrig-netdev.c index 5b4e92c14dbb4..c65df91c4f6dc 100644 --- a/drivers/leds/trigger/ledtrig-netdev.c +++ b/drivers/leds/trigger/ledtrig-netdev.c @@ -779,8 +779,10 @@ static int netdev_trig_activate(struct led_classdev *l= ed_cdev) led_set_trigger_data(led_cdev, trigger_data); =20 rc =3D register_netdevice_notifier(&trigger_data->notifier); - if (rc) + if (rc) { + dev_put(trigger_data->net_dev); kfree(trigger_data); + } =20 return rc; } --=20 2.55.0 From nobody Thu Sep 24 20:04:07 2026 Received: from mta-65-225.siemens.flowmailer.net (mta-65-225.siemens.flowmailer.net [185.136.65.225]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0FBC548F005 for ; Mon, 21 Sep 2026 09:33:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.136.65.225 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789983194; cv=none; b=tmJUTJkQ5mx+2LC3zMvIWaiEq5OFwOfxz8M3JVmKF0HCa3aOML/Cf8Y5/DiocgThVHRRvO2+lCQ+4utP5ahDyeCUd0AcVozN/ubVoF9+khim4cQg24BiGNXKREJmg5Nv17ffGC2caGs/2ckt2M+Nk+dbi23Eaof9uZubo5djNO8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789983194; c=relaxed/simple; bh=gMf0QnEAvG317ZeS8cIWL36N+Amo54q81cABkOl+g+A=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Cy8k011wc5/7QedDaTN2/ea2qLdeG3oa0VjsHN7ReuKkVslui0RRYeV8SZofRcLfqo37YCjNlTY6fNhJ8+TM6a3vQbRGaXx0A4TMoA8qIga36sAX6zsuM4HC9cRoswOGgBJfxBxbyPAY4YDi09Hq+JLpwNyD2d9ELFXppQVE0YA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=siemens.com; spf=pass smtp.mailfrom=rts-flowmailer.siemens.com; dkim=pass (2048-bit key) header.d=siemens.com header.i=alexander.sverdlin@siemens.com header.b=NLhWIuJN; arc=none smtp.client-ip=185.136.65.225 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=siemens.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rts-flowmailer.siemens.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=siemens.com header.i=alexander.sverdlin@siemens.com header.b="NLhWIuJN" Received: by mta-65-225.siemens.flowmailer.net with ESMTPSA id 2026092109330049063cd5c3000207ae for ; Mon, 21 Sep 2026 11:33:00 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=alexander.sverdlin@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=LFOdAIVED2gslTxZEL+Hdn0nPZWraS5nMXKYCet66bo=; b=NLhWIuJNE6DqWJtU08UoNQzaOHBiCdAKM4V7362lw55aYjDNbd1kiYubRgRaIxCdgdiZ5j oTwtuqC/bV3vBgSXBLY5tjsNNFhIxvPtg8vHaEwbr7eJALlddfg/Hyog9KwdN/fJQ25wb/Xl tqb4Szg8L/Z5GB+4LjJ2LvB6NjY1vWeeh82dwaZyjV1Hpe2B9LWWFLrL2P3ihSmD0m2N0aRb HQOafLd+U4tgZTAZ1O4WRTWaEwfMWKH5o7CG66q6dQQeOQLdAKDiUiW5OlTIRmi5dp7/9eNc v8li9MTomWJYfQm5InnnijLnL2VUDZYVI0MCN/vve2FQtvchteBSYq0A==; From: "A. Sverdlin" To: linux-leds@vger.kernel.org Cc: Alexander Sverdlin , Lee Jones , Pavel Machek , Andrew Lunn , "Mike Marciniszyn (Meta)" , Jakub Kicinski , Kees Cook , =?UTF-8?q?Marek=20Beh=C3=BAn?= , Christian Marangi , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2 2/4] leds: trigger: netdev: Access net_dev under trigger_data->lock in the worker Date: Mon, 21 Sep 2026 11:32:44 +0200 Message-ID: <20260921093249.3481413-3-alexander.sverdlin@siemens.com> In-Reply-To: <20260921093249.3481413-1-alexander.sverdlin@siemens.com> References: <20260921093249.3481413-1-alexander.sverdlin@siemens.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-456497:519-21489:flowmailer Content-Type: text/plain; charset="utf-8" From: Alexander Sverdlin netdev_trig_work() dereferences trigger_data->net_dev without the lock, while set_device_name() and netdev_trig_notify() dev_put() and replace it under trigger_data->lock. On NETDEV_UNREGISTER the worker can run dev_get_stats() on a netdev being freed (UAF). Take trigger_data->lock in the worker. cancel_delayed_work_sync() must then never run under that lock. Cc: stable@vger.kernel.org Closes: https://lore.kernel.org/all/20260914142116.6DAC51F000FF@smtp.kernel= .org/ Fixes: 06f502f57d0d ("leds: trigger: Introduce a NETDEV trigger") Signed-off-by: Alexander Sverdlin --- Changelog: v2: - new patch drivers/leds/trigger/ledtrig-netdev.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/leds/trigger/ledtrig-netdev.c b/drivers/leds/trigger/l= edtrig-netdev.c index c65df91c4f6dc..8b807451b642d 100644 --- a/drivers/leds/trigger/ledtrig-netdev.c +++ b/drivers/leds/trigger/ledtrig-netdev.c @@ -679,6 +679,8 @@ static void netdev_trig_work(struct work_struct *work) unsigned long interval; int invert; =20 + guard(mutex)(&trigger_data->lock); + /* If we dont have a device, insure we are off */ if (!trigger_data->net_dev) { led_set_brightness(trigger_data->led_cdev, LED_OFF); --=20 2.55.0 From nobody Thu Sep 24 20:04:07 2026 Received: from mta-64-227.siemens.flowmailer.net (mta-64-227.siemens.flowmailer.net [185.136.64.227]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B5CF648F00F for ; Mon, 21 Sep 2026 09:33:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.136.64.227 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789983197; cv=none; b=g9ykZWqFOAvYD8X3vty2oAGa0rEkRHJRUF70x82o7rq3qqPcFm5IJPXhAdUZxtXXWqXEfU2YSmkE+3qj+cSiKNxToy+2ad7YZbvMlR7/d63ExfUBIR1nSRbyCWp/k3RhDZ6pB3ZVIazYqtdcd/ETD73UpM34RMfw/b9jxjaOkiI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789983197; c=relaxed/simple; bh=SusWxfWm0euycUw5XJOnFl9NQy9l6pf5PbijN25AIMk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=h8BFAYfSL38zlrne3NZJeigEV/hNSD+jfguYYbxNoBXkCl6iZuvm6GHEdYSaT4oiQ1fApfJ496h366MZgo1dJDsziSFXhgqum4S5jRP3o4LiA97W04mztHr+lfBL+1VirwefYjK/X7V3R8yX0/vhM4Sx+u9knVyBzv/Wl5k9zf8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=siemens.com; spf=pass smtp.mailfrom=rts-flowmailer.siemens.com; dkim=pass (2048-bit key) header.d=siemens.com header.i=alexander.sverdlin@siemens.com header.b=DY8PSS5y; arc=none smtp.client-ip=185.136.64.227 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=siemens.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rts-flowmailer.siemens.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=siemens.com header.i=alexander.sverdlin@siemens.com header.b="DY8PSS5y" Received: by mta-64-227.siemens.flowmailer.net with ESMTPSA id 20260921093301eae4dceaa20002077c for ; Mon, 21 Sep 2026 11:33:01 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=alexander.sverdlin@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=Z9qU8at1gteUv+EZTN60L+eBKKac7xQWHAVXF6jkTQc=; b=DY8PSS5yui0ZfGGqnnfBSSN2vSJMCh3l+jWuL0iLQLIlmj2xAuDbDZq8ROOQtzueVRgfNJ il4rHjsPQ8gvnYGVE4cvG5qEPE+29Tlr70RD2Bk4B1NSlc1yewQgN+gpuXBOpFOsPbde1C++ wV4leIqhrAPcvr07PonQeZOjNHJkpHsWakCy9wepWYIGWoO3wVIieJPAIjrMU7A7o1Lolnju aX+Q995cleNQDG3Zz0p8GGYeLdVKrbfX8rJlFPqk+EhHwv0LGKHfrp9W6vzmu6SxdBr+dZOb nvM4mmm9ND8utOHfnh9WVI13boInVEfolNjqrNIX+qBb3ys0mDnW/tFA==; From: "A. Sverdlin" To: linux-leds@vger.kernel.org Cc: Alexander Sverdlin , Lee Jones , Pavel Machek , Andrew Lunn , "Mike Marciniszyn (Meta)" , Jakub Kicinski , Kees Cook , =?UTF-8?q?Marek=20Beh=C3=BAn?= , Christian Marangi , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2 3/4] leds: trigger: netdev: Fix sysfs_update_group() races Date: Mon, 21 Sep 2026 11:32:45 +0200 Message-ID: <20260921093249.3481413-4-alexander.sverdlin@siemens.com> In-Reply-To: <20260921093249.3481413-1-alexander.sverdlin@siemens.com> References: <20260921093249.3481413-1-alexander.sverdlin@siemens.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-456497:519-21489:flowmailer Content-Type: text/plain; charset="utf-8" From: Alexander Sverdlin The link_speed attribute group was listed in netdev_led_trigger.groups, so the LED core creates and destroys it via device_add_groups() / device_remove_groups() in led_trigger_set() (under trigger_lock), while the trigger also refreshes it with sysfs_update_group() from netdev_trig_notify() and device_name writes. With no shared lock this was observed as a sysfs splat when the trigger is re-armed during PHY link-up: sysfs: cannot create duplicate filename '...green:lan/link_10' CPU 0 (led_trigger_set) CPU 1 (linkwatch workqueue) ----------------------- --------------------------- activate(): register_netdevice_notifier() . netdev_trig_notify(NETDEV_CHANGE): . sysfs_update_group() creates "link_10" device_add_groups() creates "link_10" <- EEXIST! The mirror case (device_remove_groups() racing the notifier) leaves an orphaned sysfs file pointing at freed trigger_data, i.e. a UAF. Manage the group in the trigger: drop it from netdev_led_trigger.groups and create/destroy it in activate()/deactivate(), so the LED core never touches it. The two remaining refreshers, netdev_trig_notify() and device_name_store(), are serialized against each other by a dedicated attr_lock, and the is_visible callback takes trigger_data->lock for its supported_link_modes read. sysfs_update_group() is never called under trigger_data->lock, so it cannot deadlock against a concurrent link_* store that takes that lock. Cc: stable@vger.kernel.org Fixes: 06cdca014eca ("leds: trigger: netdev: Display only supported link sp= eed attribute") Signed-off-by: Alexander Sverdlin --- Changelog: v2: - this patch is a combined rework of patches 1&2 from v1 drivers/leds/trigger/ledtrig-netdev.c | 42 ++++++++++++++++++++------- 1 file changed, 31 insertions(+), 11 deletions(-) diff --git a/drivers/leds/trigger/ledtrig-netdev.c b/drivers/leds/trigger/l= edtrig-netdev.c index 8b807451b642d..54c6913f3afe3 100644 --- a/drivers/leds/trigger/ledtrig-netdev.c +++ b/drivers/leds/trigger/ledtrig-netdev.c @@ -57,6 +57,8 @@ =20 struct led_netdev_data { struct mutex lock; + /* Serializes link_speed group refreshes; never taken by attr stores */ + struct mutex attr_lock; =20 struct delayed_work work; struct notifier_block notifier; @@ -336,8 +338,9 @@ static ssize_t device_name_store(struct device *dev, if (ret < 0) return ret; =20 - /* Refresh link_speed visibility */ - sysfs_update_group(&dev->kobj, &netdev_trig_link_speed_attrs_group); + /* Serialize the link_speed visibility refresh against netdev_trig_notify= () */ + scoped_guard(mutex, &trigger_data->attr_lock) + sysfs_update_group(&dev->kobj, &netdev_trig_link_speed_attrs_group); =20 return size; } @@ -547,6 +550,7 @@ static umode_t netdev_trig_link_speed_visible(struct ko= bject *kobj, * Stop at the first matching entry as we care only to check if a particu= lar * speed is supported and not the kind. */ + guard(mutex)(&trigger_data->lock); for_each_set_bit(mode, supported_link_modes, __ETHTOOL_LINK_MODE_MASK_NBI= TS) { struct ethtool_link_ksettings link_ksettings; =20 @@ -606,7 +610,6 @@ static const struct attribute_group netdev_trig_attrs_g= roup =3D { =20 static const struct attribute_group *netdev_trig_groups[] =3D { &netdev_trig_attrs_group, - &netdev_trig_link_speed_attrs_group, NULL, }; =20 @@ -654,10 +657,6 @@ static int netdev_trig_notify(struct notifier_block *n= b, fallthrough; case NETDEV_CHANGE: get_device_state(trigger_data); - /* Refresh link_speed visibility */ - if (evt =3D=3D NETDEV_CHANGE) - sysfs_update_group(&led_cdev->dev->kobj, - &netdev_trig_link_speed_attrs_group); break; } =20 @@ -665,6 +664,12 @@ static int netdev_trig_notify(struct notifier_block *n= b, =20 mutex_unlock(&trigger_data->lock); =20 + if (evt =3D=3D NETDEV_CHANGE) { + guard(mutex)(&trigger_data->attr_lock); + sysfs_update_group(&led_cdev->dev->kobj, + &netdev_trig_link_speed_attrs_group); + } + return NOTIFY_DONE; } =20 @@ -747,6 +752,7 @@ static int netdev_trig_activate(struct led_classdev *le= d_cdev) return -ENOMEM; =20 mutex_init(&trigger_data->lock); + mutex_init(&trigger_data->attr_lock); =20 trigger_data->notifier.notifier_call =3D netdev_trig_notify; trigger_data->notifier.priority =3D 10; @@ -780,12 +786,23 @@ static int netdev_trig_activate(struct led_classdev *= led_cdev) =20 led_set_trigger_data(led_cdev, trigger_data); =20 + rc =3D sysfs_create_group(&led_cdev->dev->kobj, + &netdev_trig_link_speed_attrs_group); + if (rc) + goto err_free; + rc =3D register_netdevice_notifier(&trigger_data->notifier); - if (rc) { - dev_put(trigger_data->net_dev); - kfree(trigger_data); - } + if (rc) + goto err_remove_group; =20 + return 0; + +err_remove_group: + sysfs_remove_group(&led_cdev->dev->kobj, + &netdev_trig_link_speed_attrs_group); +err_free: + dev_put(trigger_data->net_dev); + kfree(trigger_data); return rc; } =20 @@ -795,6 +812,9 @@ static void netdev_trig_deactivate(struct led_classdev = *led_cdev) =20 unregister_netdevice_notifier(&trigger_data->notifier); =20 + sysfs_remove_group(&led_cdev->dev->kobj, + &netdev_trig_link_speed_attrs_group); + cancel_delayed_work_sync(&trigger_data->work); =20 dev_put(trigger_data->net_dev); --=20 2.55.0 From nobody Thu Sep 24 20:04:07 2026 Received: from mta-65-225.siemens.flowmailer.net (mta-65-225.siemens.flowmailer.net [185.136.65.225]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 35D1B478E49 for ; Mon, 21 Sep 2026 09:33:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.136.65.225 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789983197; cv=none; b=MabJ8oSW+7cD99S6KZ70RoZnvUlX/AP5+HslCn7ZR3VR4+Kz92Bht0NMPZIen7WODnl/qeUSlOf2DG3bIYryFev2tG6l+PXgoiOUAgS78pZVT0U6yyvJb/opj+EuxvmSmjJeWrxzxgvmC6UpIm4jPLVMFms5PyLtXu0gO90nbRo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789983197; c=relaxed/simple; bh=MuMf7Nt+s1wt5XM/x5dCAotMQ/UPI0nOLZmXZ9W16/U=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=C9UuIAqXlH3UwaqdhfEmAL7E+NH+7jG2Sg4eLyW6m8kEU+sdNZ+2ib+CABjzX3YNKoe+s2FiAYv6hN3MYAOWZ/1mym8IQYM1phTTWMjFiaybpunmHAs+8So+bDxNBc+J8RUdXTXbx2aP1Mo86qEiT5XdZpX0g1W5lu9Uon2tJTI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=siemens.com; spf=pass smtp.mailfrom=rts-flowmailer.siemens.com; dkim=pass (2048-bit key) header.d=siemens.com header.i=alexander.sverdlin@siemens.com header.b=pmggtXgw; arc=none smtp.client-ip=185.136.65.225 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=siemens.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rts-flowmailer.siemens.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=siemens.com header.i=alexander.sverdlin@siemens.com header.b="pmggtXgw" Received: by mta-65-225.siemens.flowmailer.net with ESMTPSA id 202609210933029ff71a9af60002073e for ; Mon, 21 Sep 2026 11:33:02 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=alexander.sverdlin@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=HuAhv2bofAntDDHM2/ps5bcWeGJaQ8lLCGnIoZQfawY=; b=pmggtXgwGfJzvH3Oe2QWGDnorcH6ETyg6Ei/K2vOos0R72ft72tC5+qghDLsHdeaYyDO01 YkxgnD4LuefZMMmgshXPlfRXeazqCwoc13zNrFSFis5g/79UgVaeFAsGQCEEhwMaXXZfp/Nz OnbGFBZ+DFh2JCWpaS2gkBgnfyCWB7exU9VG2xfdMKp/LvA8DIRsQb3Kc3Nuzx5WIf5nNZlJ VQ8S/z12nnFY3lAckFbNPbHS4qTJCoEgoHR9MIghRW5REylXk5nYTH14zcljW7q+oiLDfQI7 WtKPKCWTXuBaA5bgKEkZ71+wyEir1kfSVJ9VSQNH1CZRryCoPrgi3iaw==; From: "A. Sverdlin" To: linux-leds@vger.kernel.org Cc: Alexander Sverdlin , Lee Jones , Pavel Machek , Andrew Lunn , "Mike Marciniszyn (Meta)" , Jakub Kicinski , Kees Cook , =?UTF-8?q?Marek=20Beh=C3=BAn?= , Christian Marangi , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2 4/4] leds: trigger: netdev: Serialize mode/interval stores with trigger lock Date: Mon, 21 Sep 2026 11:32:46 +0200 Message-ID: <20260921093249.3481413-5-alexander.sverdlin@siemens.com> In-Reply-To: <20260921093249.3481413-1-alexander.sverdlin@siemens.com> References: <20260921093249.3481413-1-alexander.sverdlin@siemens.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-456497:519-21489:flowmailer Content-Type: text/plain; charset="utf-8" From: Alexander Sverdlin netdev_led_attr_store() and interval_store() update ->mode and run set_baseline_state() without trigger_data->lock. kernfs only serializes writes to the same file, so two attribute writes race on the non-atomic read-modify-write of ->mode: CPU0 (echo 1 > link_10) CPU1 (echo 1 > link_100) ----------------------- ------------------------ mode =3D trigger_data->mode; mode =3D trigger_data->mode; set_bit(LINK_10, &mode); set_bit(LINK_100, &mode); trigger_data->mode =3D mode; trigger_data->mode =3D mode; // LINK_10 lo= st They also race the notifier's link-state and ->hw_control updates. Take trigger_data->lock in both stores. netdev_trig_work() also holds it, so use the async cancel_delayed_work() (a sync cancel would deadlock). Cc: stable@vger.kernel.org Fixes: d5e01266e7f5 ("leds: trigger: netdev: add additional specific link s= peed mode") Signed-off-by: Alexander Sverdlin --- Changelog: v2: - reduced verbosity both in the comments and in commit message - dropped sync from cancel_delayed_work() (worker now takes the lock) drivers/leds/trigger/ledtrig-netdev.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/leds/trigger/ledtrig-netdev.c b/drivers/leds/trigger/l= edtrig-netdev.c index 54c6913f3afe3..92a6a456130c9 100644 --- a/drivers/leds/trigger/ledtrig-netdev.c +++ b/drivers/leds/trigger/ledtrig-netdev.c @@ -385,7 +385,7 @@ static ssize_t netdev_led_attr_store(struct device *dev= , const char *buf, { struct led_netdev_data *trigger_data =3D led_trigger_get_drvdata(dev); struct led_classdev *led_cdev =3D trigger_data->led_cdev; - unsigned long state, mode =3D trigger_data->mode; + unsigned long state, mode; int ret; int bit; =20 @@ -417,6 +417,10 @@ static ssize_t netdev_led_attr_store(struct device *de= v, const char *buf, return -EINVAL; } =20 + /* async cancel: the worker takes this lock */ + guard(mutex)(&trigger_data->lock); + + mode =3D trigger_data->mode; if (state) set_bit(bit, &mode); else @@ -435,7 +439,7 @@ static ssize_t netdev_led_attr_store(struct device *dev= , const char *buf, test_bit(TRIGGER_NETDEV_LINK_100000, &mode))) return -EINVAL; =20 - cancel_delayed_work_sync(&trigger_data->work); + cancel_delayed_work(&trigger_data->work); =20 trigger_data->mode =3D mode; trigger_data->hw_control =3D can_hw_control(trigger_data); @@ -506,10 +510,14 @@ static ssize_t interval_store(struct device *dev, =20 /* impose some basic bounds on the timer interval */ if (value >=3D 5 && value <=3D 10000) { - cancel_delayed_work_sync(&trigger_data->work); + mutex_lock(&trigger_data->lock); + + cancel_delayed_work(&trigger_data->work); =20 atomic_set(&trigger_data->interval, msecs_to_jiffies(value)); set_baseline_state(trigger_data); /* resets timer */ + + mutex_unlock(&trigger_data->lock); } =20 return size; --=20 2.55.0