commit 8887516f01066375d70162a978b3fd9d73695878
author Li Zhong <floridsleeves@gmail.com> Fri Sep 23 17:17:51 2022 -0700
committer Guenter Roeck <linux@roeck-us.net> Sun Sep 25 14:22:11 2022 -0700
tree 03d4397d8274b4a65e778f7ac0e52b4ccf83e7f1
parent f9c0cf8f26de367c58e48b02b1cdb9c377626e6f

hwmon: (adm9240) fix data race in adm9240_fan_read

In
adm9240_read()
  adm9240_fan_read()
    adm9240_write_fan_div(),

it assumes that the caller of adm9240_write_fan_div() must hold
data->update_lock. Otherwise, it may cause data races when data is
updated by other threads.

Signed-off-by: Li Zhong <floridsleeves@gmail.com>
Link: https://lore.kernel.org/r/20220924001751.1726369-1-floridsleeves@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>

drivers/hwmon/adm9240.c

diff --git a/drivers/hwmon/adm9240.c b/drivers/hwmon/adm9240.c
index 483cd75..40e3558 100644
--- a/drivers/hwmon/adm9240.c
+++ b/drivers/hwmon/adm9240.c
@@ -501,17 +501,23 @@ static int adm9240_fan_read(struct device *dev, u32 attr, int channel, long *val
 
 	switch (attr) {
 	case hwmon_fan_input:
+		mutex_lock(&data->update_lock);
 		err = regmap_read(data->regmap, ADM9240_REG_FAN(channel), &regval);
-		if (err < 0)
+		if (err < 0) {
+			mutex_unlock(&data->update_lock);
 			return err;
+		}
 		if (regval == 255 && data->fan_div[channel] < 3) {
 			/* adjust fan clock divider on overflow */
 			err = adm9240_write_fan_div(data, channel,
 						    ++data->fan_div[channel]);
-			if (err)
+			if (err) {
+				mutex_unlock(&data->update_lock);
 				return err;
+			}
 		}
 		*val = FAN_FROM_REG(regval, BIT(data->fan_div[channel]));
+		mutex_unlock(&data->update_lock);
 		break;
 	case hwmon_fan_div:
 		*val = BIT(data->fan_div[channel]);