linux-kernel - Re: [PATCH] pcmcia: Fix broken abuse of dev->driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080922215617.GA13057@comet.dominikbrodowski.net>
Date:	Mon, 22 Sep 2008 23:56:17 +0200
From:	Dominik Brodowski <linux@...inikbrodowski.net>
To:	Alan Cox <alan@...rguk.ukuu.org.uk>
Cc:	torvalds@...l.org, linux-kernel@...r.kernel.org,
	linux-pcmcia@...ts.infradead.org
Subject: Re: [PATCH] pcmcia: Fix broken abuse of dev->driver_data

Alan,

(CC: linux-pcmcia added)

Many thanks for finding this bug.

On Mon, Sep 22, 2008 at 03:58:14PM +0100, Alan Cox wrote:
> PCMCIA abuses dev->private_data in the probe methods. Unfortunately it
> continues to abuse it after calling drv->probe() which leads to crashes and
> other nasties (such as bogus probes of multifunction devices) giving errors like

Well, PCMCIA drivers have (struct pcmcia_device *) p_dev->priv available and
use this regularly, so using dev->private_data never has been supported.
Nonetheless, let's add support for using dev->private_data also for PCMCIA
devices and remove p_dev->priv eventually.

> As its close to the final release just move the hack so it works out,
> hopefully someone will be sufficiently embarrassed to produce a nice rework
> for 2.6.28.

Could you remove this from the changelog entry, please?


> @@ -426,6 +426,18 @@ static int pcmcia_device_probe(struct device * dev)
>  	p_dev = to_pcmcia_dev(dev);
>  	p_drv = to_pcmcia_drv(dev->driver);
>  	s = p_dev->socket;
> +	

trailing whitespace

> +	/* The PCMCIA code passes the match data in via dev->driver_data
> +	 * which is an ugly hack. Once the driver probe is called it may
> +	 * and often will overwrite the match data so we must save it first 

trailing whitespace

>  	if (did && (did->match_flags & PCMCIA_DEV_ID_MATCH_DEVICE_NO) &&
>  	    (p_dev->socket->device_count == 1) && (p_dev->device_no ==
> 0)) pcmcia_add_device_later(p_dev->socket, 0);

uh?

>  
> - put_module:
> +put_module:
>  	if (ret)
>  		module_put(p_drv->owner);
> - put_dev:
> +put_dev:

unrelated -- please do not change it this time.

Best and thanks again,

	Dominik
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/