linux-kernel - [RFT PATCH 1/2] ieee1394: nodemgr: fix rwsem recursion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <tkrat.a76041f4792feb5b@s5r6.in-berlin.de>
Date:	Wed, 6 Sep 2006 19:04:38 +0200 (CEST)
From:	Stefan Richter <stefanr@...6.in-berlin.de>
To:	linux1394-devel@...ts.sourceforge.net
cc:	linux-kernel@...r.kernel.org, Andrew Morton <akpm@...l.org>,
	Miles Lane <miles.lane@...il.com>,
	Herbert Xu <herbert@...dor.apana.org.au>,
	Ben Collins <bcollins@...ntu.com>, Greg KH <gregkh@...e.de>
Subject: [RFT PATCH 1/2] ieee1394: nodemgr: fix rwsem recursion

nodemgr_update_pdrv grabbed an rw semaphore (as reader) which was
already taken by its caller's caller, nodemgr_probe_ne (as reader too).
Reported by Miles Lane, call path pointed out by Arjan van de Ven.

FIXME:
Shouldn't we rather use class->sem there, not class->subsys.rwsem?

Signed-off-by: Stefan Richter <stefanr@...6.in-berlin.de>
---
Index: linux/drivers/ieee1394/nodemgr.c
===================================================================
--- linux.orig/drivers/ieee1394/nodemgr.c	2006-08-30 20:47:57.000000000 +0200
+++ linux/drivers/ieee1394/nodemgr.c	2006-09-06 19:03:24.000000000 +0200
@@ -1316,6 +1316,7 @@ static void nodemgr_node_scan(struct hos
 }
 
 
+/* Caller needs to hold nodemgr_ud_class.subsys.rwsem as reader. */
 static void nodemgr_suspend_ne(struct node_entry *ne)
 {
 	struct class_device *cdev;
@@ -1368,15 +1369,14 @@ static void nodemgr_resume_ne(struct nod
 }
 
 
+/* Caller needs to hold nodemgr_ud_class.subsys.rwsem as reader. */
 static void nodemgr_update_pdrv(struct node_entry *ne)
 {
 	struct unit_directory *ud;
 	struct hpsb_protocol_driver *pdrv;
-	struct class *class = &nodemgr_ud_class;
 	struct class_device *cdev;
 
-	down_read(&class->subsys.rwsem);
-	list_for_each_entry(cdev, &class->children, node) {
+	list_for_each_entry(cdev, &nodemgr_ud_class.children, node) {
 		ud = container_of(cdev, struct unit_directory, class_dev);
 		if (ud->ne != ne || !ud->device.driver)
 			continue;
@@ -1389,7 +1389,6 @@ static void nodemgr_update_pdrv(struct n
 			up_write(&ud->device.bus->subsys.rwsem);
 		}
 	}
-	up_read(&class->subsys.rwsem);
 }
 
 
@@ -1420,6 +1419,8 @@ static void nodemgr_irm_write_bc(struct 
 }
 
 
+/* Caller needs to hold nodemgr_ud_class.subsys.rwsem as reader because the
+ * calls to nodemgr_update_pdrv() and nodemgr_suspend_ne() here require it. */
 static void nodemgr_probe_ne(struct host_info *hi, struct node_entry *ne, int generation)
 {
 	struct device *dev;


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/