linux-kernel - Re: [PATCH] fbmem: copy_from/to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 20 Jan 2009 09:21:55 +0100
From:	Andrea Righi <righi.andrea@...il.com>
To:	Krzysztof Helt <krzysztof.h1@...pl>
Cc:	Johannes Weiner <hannes@...xchg.org>,
	Dave Jones <davej@...hat.com>,
	Johannes Weiner <hannes@...urebad.de>,
	Harvey Harrison <harvey.harrison@...il.com>,
	Stefan Richter <stefanr@...6.in-berlin.de>,
	Andrew Morton <akpm@...ux-foundation.org>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] fbmem: copy_from/to_user() with mutex held (v2)

On Mon, Jan 19, 2009 at 9:54 PM, Krzysztof Helt <krzysztof.h1@...pl> wrote:
> On Mon, 19 Jan 2009 12:04:04 +0100
> Andrea Righi <righi.andrea@...il.com> wrote:
>
>> Avoid to call copy_from/to_user() with fb_info->lock mutex held in fbmem
>> ioctl().
>>
>> fb_mmap() is called under mm->mmap_sem (A) held, that also acquires
>> fb_info->lock (B); fb_ioctl() takes fb_info->lock (B) and does
>> copy_from/to_user() that might acquire mm->mmap_sem (A), causing a
>> deadlock.
>>
>> NOTE: it doesn't push down the fb_info->lock in each own driver's
>> fb_ioctl(), so there're still potential deadlocks somewhere.
>>
>
>> diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
>> index 756efeb..fe6033e 100644
>> --- a/drivers/video/fbmem.c
>> +++ b/drivers/video/fbmem.c
>> @@ -1013,25 +1013,26 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
> (...)
>>       case FBIOPUT_VSCREENINFO:
>> -             if (copy_from_user(&var, argp, sizeof(var))) {
>> -                     ret =  -EFAULT;
>> -                     break;
>> -             }
>> +             if (copy_from_user(&var, argp, sizeof(var)))
>> +                     return -EFAULT;
>> +             if (!lock_fb_info(info))
>> +                     return -ENODEV;
>>               acquire_console_sem();
>>               info->flags |= FBINFO_MISC_USEREVENT;
>>               ret = fb_set_var(info, &var);
>> @@ -1041,104 +1042,109 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
>>                       ret = -EFAULT;
>>               break;
>
> I don't see a call to unlock_fb_info(info) in the case for FBIOPUT_VSCREENINFO.
> Is it intentional?

No, it's a bug :(. I'll post a new patch soon.

Thanks for reviewing!
-Andrea

>
> Kind regards,
> Krzysztof
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/