{"id":2212397,"url":"http://patchwork.ozlabs.org/api/1.1/patches/2212397/","web_url":"http://patchwork.ozlabs.org/project/rtc-linux/patch/20260317-irq_data-v1-1-a2741002be60@igalia.com/","project":{"id":9,"url":"http://patchwork.ozlabs.org/api/1.1/projects/9/","name":"Linux RTC development","link_name":"rtc-linux","list_id":"linux-rtc.vger.kernel.org","list_email":"linux-rtc@vger.kernel.org","web_url":"","scm_url":"","webscm_url":""},"msgid":"<20260317-irq_data-v1-1-a2741002be60@igalia.com>","date":"2026-03-17T23:22:16","name":"rtc: add data_race() in rtc_dev_poll()","commit_ref":null,"pull_url":null,"state":"accepted","archived":false,"hash":"2b0e7e2bad09fbe8f2508e68dfe9178255b78c2c","submitter":{"id":92896,"url":"http://patchwork.ozlabs.org/api/1.1/people/92896/","name":"Mauricio Faria de Oliveira","email":"mfo@igalia.com"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/rtc-linux/patch/20260317-irq_data-v1-1-a2741002be60@igalia.com/mbox/","series":[{"id":496378,"url":"http://patchwork.ozlabs.org/api/1.1/series/496378/","web_url":"http://patchwork.ozlabs.org/project/rtc-linux/list/?series=496378","date":"2026-03-17T23:22:16","name":"rtc: add data_race() in rtc_dev_poll()","version":1,"mbox":"http://patchwork.ozlabs.org/series/496378/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2212397/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2212397/checks/","tags":{},"headers":{"Return-Path":"\n <linux-rtc+bounces-6230-incoming=patchwork.ozlabs.org@vger.kernel.org>","X-Original-To":["incoming@patchwork.ozlabs.org","linux-rtc@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n unprotected) header.d=igalia.com header.i=@igalia.com header.a=rsa-sha256\n header.s=20170329 header.b=mpkGECk7;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c0a:e001:db::12fc:5321; helo=sea.lore.kernel.org;\n envelope-from=linux-rtc+bounces-6230-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key)\n header.d=igalia.com header.i=@igalia.com header.b=\"mpkGECk7\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=213.97.179.56","smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=igalia.com","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=igalia.com"],"Received":["from sea.lore.kernel.org (sea.lore.kernel.org\n [IPv6:2600:3c0a:e001:db::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fb7Qh4WMbz1xyt\n\tfor <incoming@patchwork.ozlabs.org>; Wed, 18 Mar 2026 10:27:08 +1100 (AEDT)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id BD1C630416EB\n\tfor <incoming@patchwork.ozlabs.org>; Tue, 17 Mar 2026 23:22:32 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 957E13C5544;\n\tTue, 17 Mar 2026 23:22:31 +0000 (UTC)","from fanzine2.igalia.com (fanzine2.igalia.com [213.97.179.56])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id E2B3F54723;\n\tTue, 17 Mar 2026 23:22:27 +0000 (UTC)","from 186-249-150-8.shared.desktop.com.br ([186.249.150.8]\n helo=[192.168.1.66])\n\tby fanzine2.igalia.com with esmtpsa\n\t(Cipher TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim)\n\tid 1w2dk0-002WL8-7R; Wed, 18 Mar 2026 00:22:24 +0100"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1773789751; cv=none;\n b=K1aA6WjoTRlAyg9eFf2D1mflfixa+cLgnuZXKkfbSxlYrWrFMfisNBOhvj1w8RtDIgd9yTPCHrAShLyN0d9NBYHOO1ZuEPoh5QUsKa/KSiZNtXqSPAmU9QFva/eOjJVHZf5yvT43/P25j8yqwtzH4eGF+tg+Iih8YnsZ7tIf4oo=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1773789751; c=relaxed/simple;\n\tbh=4SczZoJEjSUHbLzM6JBY7TbA3ZANhcxEFDhdqplyZ68=;\n\th=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc;\n b=iUslxGs6rbQTFBr6UiFzRmOKmD9JW38rIFVFU4aoIB/T5JPWU2EXw9Cz7QBC236CuBIZFsNrMR/2f4jEnM12IzsI4vooYL/5mkrgq+1YXnJNwD+LQim0ftPj9CqDTlEdQmWSxUxn4SwXiaNwlN53ZzBGRM9CG1WlXg3op0uazS4=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=igalia.com;\n spf=pass smtp.mailfrom=igalia.com;\n dkim=pass (2048-bit key) header.d=igalia.com header.i=@igalia.com\n header.b=mpkGECk7; arc=none smtp.client-ip=213.97.179.56","DKIM-Signature":"v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=igalia.com;\n\ts=20170329; h=Cc:To:Message-Id:Content-Transfer-Encoding:Content-Type:\n\tMIME-Version:Subject:Date:From:Sender:Reply-To:Content-ID:Content-Description\n\t:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:\n\tIn-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:\n\tList-Post:List-Owner:List-Archive;\n\tbh=3bmH22YKAPdkZ8EbQVk3aqZQBnzWSdw/b2y+dHwmsY0=; b=mpkGECk7DGobyCPn5QPZ75DaYU\n\tRsctmF9FeTIU/8IwwswM17rDnjeVRoojJDH6cnR+YrFAKaZMHgGJw3/zrzV2d9VwHKbLlJ2P/S6BZ\n\tH2Fea5GSXR5FjGwnjUWm8fOaWHo6W7sRM02zEgXoEf/KwHUzgrEFMDssrvh9+ohcFNudX4QOYkNmY\n\tEcKFYh84meE1vXQnaSfIweKGneo0k7iaXxgtCPhj2EfqrjwTah+obcX+fg4RqnrXommFti9O5iCac\n\t5a8swMJt8RihEkMbOcsMaZ7Wa6Z0oWESrgN8D/+UmTLhB3kGxh7/sWWTFw4ANy2eb9yw99azYHT48\n\thX5iR8kw==;","From":"Mauricio Faria de Oliveira <mfo@igalia.com>","Date":"Tue, 17 Mar 2026 20:22:16 -0300","Subject":"[PATCH] rtc: add data_race() in rtc_dev_poll()","Precedence":"bulk","X-Mailing-List":"linux-rtc@vger.kernel.org","List-Id":"<linux-rtc.vger.kernel.org>","List-Subscribe":"<mailto:linux-rtc+subscribe@vger.kernel.org>","List-Unsubscribe":"<mailto:linux-rtc+unsubscribe@vger.kernel.org>","MIME-Version":"1.0","Content-Type":"text/plain; charset=\"utf-8\"","Content-Transfer-Encoding":"7bit","Message-Id":"<20260317-irq_data-v1-1-a2741002be60@igalia.com>","X-B4-Tracking":"v=1; b=H4sIACfiuWkC/6tWKk4tykwtVrJSqFYqSi3LLM7MzwNyDHUUlJIzE\n vPSU3UzU4B8JSMDIzMDY0Nz3cyiwviUxJJE3VSDtOQUc8sUU2PjZCWg8oKi1LTMCrBR0bG1tQD\n t+oPGWgAAAA==","X-Change-ID":"20260317-irq_data-e0fcd79d533c","To":"Alexandre Belloni <alexandre.belloni@bootlin.com>","Cc":"linux-rtc@vger.kernel.org, linux-kernel@vger.kernel.org,\n kernel-dev@igalia.com,\n syzbot+2d4127acca35ed7b31ad@syzkaller.appspotmail.com,\n Mauricio Faria de Oliveira <mfo@igalia.com>","X-Mailer":"b4 0.14.2"},"content":"The unlocked read of rtc->irq_data in rtc_dev_poll() can race with\nthe write in rtc_handle_legacy_irq() and also, theoretically, with\nthe write in rtc_dev_read().\n\nThese races should be safe (see inline comment), thus annotate the\nread with data_race() for KCSAN.\n\nReported-by: syzbot+2d4127acca35ed7b31ad@syzkaller.appspotmail.com\nCloses: https://syzbot.org/bug?extid=2d4127acca35ed7b31ad\nSigned-off-by: Mauricio Faria de Oliveira <mfo@igalia.com>\n---\nCompile-tested on next-20260317.\n---\n drivers/rtc/dev.c | 11 ++++++++++-\n 1 file changed, 10 insertions(+), 1 deletion(-)\n\n\n---\nbase-commit: 8e5a478b6d6a5bb0a3d52147862b15e4d826af19\nchange-id: 20260317-irq_data-e0fcd79d533c\n\nBest regards,","diff":"diff --git a/drivers/rtc/dev.c b/drivers/rtc/dev.c\nindex baf1a8ca8b2b1ea806c56b06926a03975b3636a8..8ba7c25d2565ef4139594976881aaee18e16a048 100644\n--- a/drivers/rtc/dev.c\n+++ b/drivers/rtc/dev.c\n@@ -195,7 +195,16 @@ static __poll_t rtc_dev_poll(struct file *file, poll_table *wait)\n \n \tpoll_wait(file, &rtc->irq_queue, wait);\n \n-\tdata = rtc->irq_data;\n+\t/*\n+\t * This read can race with the write in rtc_handle_legacy_irq().\n+\t *\n+\t * - If this check misses a zero to non-zero transition the next check\n+\t *   will pick it up (rtc_handle_legacy_irq() wakes up rtc->irq_queue).\n+\t * - Non-zero to non-zero transition misses do not change return value.\n+\t * - And a non-zero to zero transition is unlikely to be missed, since\n+\t *   it occurs on rtc_dev_read(), during which polling is not expected.\n+\t */\n+\tdata = data_race(rtc->irq_data);\n \n \treturn (data != 0) ? (EPOLLIN | EPOLLRDNORM) : 0;\n }\n","prefixes":[]}