linux-kernel - Re: [PATCH v6 05/14] platform/x86: dell-wmi-descriptor: split WMI descriptor into it's own driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 10 Oct 2017 10:17:49 +0200
From:   Pali Rohár <pali.rohar@...il.com>
To:     Mario Limonciello <mario.limonciello@...l.com>
Cc:     dvhart@...radead.org, Andy Shevchenko <andy.shevchenko@...il.com>,
        LKML <linux-kernel@...r.kernel.org>,
        platform-driver-x86@...r.kernel.org,
        Andy Lutomirski <luto@...nel.org>, quasisec@...gle.com,
        rjw@...ysocki.net, mjg59@...gle.com, hch@....de,
        Greg KH <greg@...ah.com>
Subject: Re: [PATCH v6 05/14] platform/x86: dell-wmi-descriptor: split WMI
 descriptor into it's own driver

On Monday 09 October 2017 17:51:43 Mario Limonciello wrote:
> +bool dell_wmi_get_interface_version(u32 *version)
> +{
> +	struct descriptor_priv *priv;
> +
> +	priv = list_first_entry_or_null(&wmi_list,
> +					struct descriptor_priv,
> +					list);
> +	if (!priv)
> +		return false;

This introduce race condition. In case callee of this function is
executed before binding 8D9DDCBC-A997-11DA-B012-B622A1EF5492 WMI device
into this dell-wmi-descriptor driver, then this function
dell_wmi_get_interface_version() returns false. Even it is running on
supported machine.

Loading of modulus and also binding devices to drivers (registered by
modules) is is asynchronous.

In case everything is linked into vmlinux binary, this problem could
happen too. Binding & initialization of WMI device to this driver can be
postponed and callee (dell-wmi) would get false.

> +	*version = priv->interface_version;
> +	return true;
> +}
> +EXPORT_SYMBOL_GPL(dell_wmi_get_interface_version);
> +
> +bool dell_wmi_get_size(u32 *size)
> +{
> +	struct descriptor_priv *priv;
> +
> +	priv = list_first_entry_or_null(&wmi_list,
> +					struct descriptor_priv,
> +					list);
> +	if (!priv)
> +		return false;

And same there.

> +	*size = priv->size;
> +	return true;
> +}
> +EXPORT_SYMBOL_GPL(dell_wmi_get_size);

-- 
Pali Rohár
pali.rohar@...il.com