linux-kernel - [PATCH] fix unchecked mutex_lock_interruptible (was Re: use mutex instead of semaphore in RocketPort driver)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <a781481a0705230555j6fcf46eav43cc95f6d1a7ae6f@mail.gmail.com>
Date:	Wed, 23 May 2007 18:25:49 +0530
From:	"Satyam Sharma" <satyam.sharma@...il.com>
To:	"Jiri Slaby" <jirislaby@...il.com>
Cc:	"Simon Arlott" <simon@...e.lp0.eu>,
	"Matthias Kaehlcke" <matthias.kaehlcke@...il.com>,
	"Arjan van de Ven" <arjan@...radead.org>,
	"Linux Kernel Mailing List" <linux-kernel@...r.kernel.org>,
	"Andrew Morton" <akpm@...ux-foundation.org>
Subject: [PATCH] fix unchecked mutex_lock_interruptible (was Re: use mutex instead of semaphore in RocketPort driver)

On 5/23/07, Jiri Slaby <jirislaby@...il.com> wrote:
> Simon Arlott napsal(a):
> > On 22/05/07 21:06, Matthias Kaehlcke wrote:
> >> would the following resolve the problem?
> >>
> >> if(mutex_lock_interruptible(&info->write_mtx))         return
> >> -ERESTARTSYS
> >>
> >> thanks for your comments

Hum. I remember suggesting the fix when this came few weeks back,
somehow the older version seems to have made it into Linus' tree.

> > No. At least one user of tty_operations/tty_driver's write function
> > doesn't check the return value so it would never be retried, mutex_lock
> > should be used instead.

Replacing mutex_lock_interruptible() with a mutex_lock() could be a
change in behaviour visible to userspace. Best to continue to use
_interruptible. Returning EINTR would be safe choice because if
Simon's right that this isn't retried, we could end up breaking
userspace that isn't quite ready to see ERESTARTSYS coming out of
a write(2), but ...

> Who? There are some drivers that returns ERESTARTSYS from write function.

Right, several others in drivers/char/ do return ERESTARTSYS. Hope
somebody picks this up -- no email listed in MAINTAINERS for this.

---

Check the return of mutex_lock_interruptible() in drivers/char/rocket.c
and return ERESTARTSYS if we were interrupted.

Signed-off-by: Satyam Sharma <satyam.sharma@...il.com>

---

 drivers/char/rocket.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

---

diff -ruNp a/drivers/char/rocket.c b/drivers/char/rocket.c
--- a/drivers/char/rocket.c	2007-05-20 04:11:54.000000000 +0530
+++ b/drivers/char/rocket.c	2007-05-23 18:14:35.000000000 +0530
@@ -1702,7 +1702,8 @@ static int rp_write(struct tty_struct *t
 	if (count <= 0 || rocket_paranoia_check(info, "rp_write"))
 		return 0;

-	mutex_lock_interruptible(&info->write_mtx);
+	if (mutex_lock_interruptible(&info->write_mtx))
+		return -ERESTARTSYS;

 #ifdef ROCKET_DEBUG_WRITE
 	printk(KERN_INFO "rp_write %d chars...", count);
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/