linux-kernel - Re: [RFC][-rc9 PATCH] Bluetooth: fix oops in rfcomm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <19f34abd0807132323r3c919aq88ecaf572da765cb@mail.gmail.com>
Date:	Mon, 14 Jul 2008 08:23:40 +0200
From:	"Vegard Nossum" <vegard.nossum@...il.com>
To:	"Dave Young" <hidave.darkstar@...il.com>
Cc:	"Soeren Sonnenburg" <kernel@....de>,
	"Marcel Holtmann" <marcel@...tmann.org>,
	"David Woodhouse" <dwmw2@...radead.org>,
	linux-kernel@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: [RFC][-rc9 PATCH] Bluetooth: fix oops in rfcomm

On Mon, Jul 14, 2008 at 4:41 AM, Dave Young <hidave.darkstar@...il.com> wrote:
>> This patch attempts to correct this by only removing the device from the
>> internal rfcomm list of devices at the final unregister, so that the id
>> won't get reused until the device has been completely destructed.
>
> It looks good, I agree with your change.

Thanks for looking!

>        if (IS_ERR(dev->tty_dev)) {
>                err = PTR_ERR(dev->tty_dev);
>                list_del(&dev->list);
>                kfree(dev);
>                return err;
>        }
>
> The list_del need to be protected as well.

After looking at the code once again I wonder if we should not extend
the protection even a bit further. Just below, we have this:

        if (device_create_file(dev->tty_dev, &dev_attr_address) < 0)

..which means that we could theoretically get here, be preempted by
another process which 1. releases the device id, and 2. recreates the
same device id. When we resume execution of the first task,
device_create_file() would be called for a file that already exists.

Should the rfcomm_dev_lock be extended to include protecting these
things as well? It seems somehow wrong, but I am not sure how it
should be done correctly either.


Vegard

-- 
"The animistic metaphor of the bug that maliciously sneaked in while
the programmer was not looking is intellectually dishonest as it
disguises that the error is the programmer's own creation."
	-- E. W. Dijkstra, EWD1036
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/