linux-kernel - race in sysfs between sysfs_remove

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <200612012343.07251.oliver@neukum.org>
Date:	Fri, 1 Dec 2006 23:43:06 +0100
From:	Oliver Neukum <oliver@...kum.org>
To:	maneesh@...ibm.com, gregkh@...e.com,
	Alan Stern <stern@...land.harvard.edu>,
	linux-usb-devel@...ts.sourceforge.net,
	kernel list <linux-kernel@...r.kernel.org>
Subject: race in sysfs between sysfs_remove_file() and read()/write() #2

Hi,

Alan Stern has discovered a race in sysfs, whereby driver callbacks could be
called after sysfs_remove_file() has run. The attached patch should fix it.

It introduces a new data structure acting as a collection of all sysfs_buffers
associated with an attribute. Upon removal of an attribute the buffers are
marked orphaned and IO on them returns -ENODEV. Thus sysfs_remove_file()
makes sure that sysfs won't bother a driver after that call, making it safe
to free the associated data structures and to unload the driver.

	Regards
		Oliver

View attachment "sysfs2race.diff" of type "text/x-diff" (6612 bytes)