linux-kernel - Re: [PATCH] Kobjects: drop child->parent ref at unregistration

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44L0.0711262124090.22315-100000@netrider.rowland.org>
Date:	Mon, 26 Nov 2007 21:29:36 -0500 (EST)
From:	Alan Stern <stern@...land.harvard.edu>
To:	Andrew Morton <akpm@...ux-foundation.org>
cc:	greg@...ah.com, <kay.sievers@...y.org>,
	<linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] Kobjects: drop child->parent ref at unregistration

On Mon, 26 Nov 2007, Andrew Morton wrote:

> On Mon, 19 Nov 2007 10:53:40 -0500 (EST)
> Alan Stern <stern@...land.harvard.edu> wrote:
> 
> > This patch (as1015) reverts changes that were made to the driver core
> > about four years ago.  The intent back then was to avoid certain kinds
> > of invalid memory accesses by leaving kernel objects allocated as long
> > as any of their children were still allocated.  The original and
> > correct approach was to wait only as long as any children were still
> > _registered_; that's what this patch reinstates.
> 
> What happened with this?

As far as I know, it's on Greg's queue.

> > This fixes a problem in the SCSI core made visible by the class_device
> > to regular device conversion: A reference loop (scsi_device holds
> > reference to request_queue, which is the child of a gendisk, which is
> > the child of the scsi_device) prevents the data structures from being
> > released, even though they are deregistered okay.
> > 
> > It's possible that this change will cause a few bugs to surface,
> > things that have been hidden for several years.  They can be fixed
> > easily enough by having the child device take an explicit reference to
> > the parent whenever needed.
> > 
> 
> How will such bugs manifest?  Ideally via a nice printk and a stack trace
> followed by damage avoidance.

They will manifest in the same way as any other use-after-free bug: an 
oops message and either death of the current process or a system hang.

Obviously I'm not aware of any such bugs -- if I were, I'd fix them.  
Greg has expressed concern that some USB serial drivers might have this 
problem.  I'll do what testing I can (not much because I don't have any 
USB serial devices).

> If it's via a mysterious crash or something similarly obscure then can we
> improve that?

I can't think of anything offhand.  Maybe someone else can.

Alan Stern

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/