linux-kernel - Re: [RFC PATCH] char: misc: Init misc->list in a safe way

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 28 Jun 2017 07:18:15 +0200
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     Zhongping Tan (谭中平) 
        <Zhongping.Tan@...eadtrum.com>, Arnd Bergmann <arnd@...db.de>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [RFC PATCH] char: misc: Init misc->list in a safe way

On Wed, Jun 28, 2017 at 09:54:32AM +0800, Orson Zhai wrote:
> We found the device is "fm". We highly suspect that fm driver call
> misc_register twice and reinitialize list to make ->pre & ->next
> pointing to himself.
> 
> Meanwhile, we checked fm driver and found nothing obviously wrong in the code.

Do you have a pointer to this driver?  Is it in the kernel tree?

> Consider that this is a crash after 46 hours continuous power-on/off,
> it maybe caused by some special cases we are hard to know for now.

What would cause this driver to want to register/unregister itself?  Is
it "recycling" the misc structure, or creating it new each time?

And what kernel version are you testing here?

> We think it might make some sence to add protection code into
> misc_register() at first.

To protect from "foolish" callers?  Usually we fix the calling code to
not do foolish things. :)

thanks,

greg k-h