Re: [PATCH] auxdisplay: linedisp: serialize sysfs message updates

[Andy Shevchenko]

On Sat, Aug 1, 2026 at 11:02 PM Laxman Acharya Padhya
<acharyalaxman8848@xxxxxxxxx> wrote:
>
> message_store() frees and replaces linedisp->message, restarts the
> scroll timer, and may immediately read the new buffer again to update the
> display. message_show() and scroll_step_ms_store() can run concurrently
> through separate sysfs opens, because kernfs only serializes operations per
> open file.
>
> That leaves the display state vulnerable to concurrent readers and writers.
> A racing write can free a message buffer that another sysfs write is still
> copying from, and a sysfs read can format a message pointer while another
> thread frees and replaces it.
>
> Serialize sysfs access to the display state with a mutex. Keep the timer
> callback lockless, and use timer_delete_sync() under the mutex so sysfs
> writers wait for any in-flight scroll callback before changing the
> message, scroll position, or scroll rate.

I think this is an attempt to partially work around the (security)
issue that Rajat reported earlier. Rajat, can you check if it's
related?


-- 
With Best Regards,
Andy Shevchenko