linux-kernel - Re: [BUG] hidraw.c: double mutex

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Mon, 12 Oct 2009 11:25:13 +0200 (CEST)
From:	Jiri Kosina <jkosina@...e.cz>
To:	iceberg <iceberg@...ras.ru>
Cc:	linux-input@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [BUG] hidraw.c: double mutex_lock

On Mon, 12 Oct 2009, iceberg wrote:

> 	KERNEL_VERSION: 2.6.31
> 	DESCRIBE:
> 	In driver ./drivers/hid/hidraw.c in function hidraw_read may be 
> double mutex_lock:
> 
> Path:
> 1. line 50: begin first iteration of "while(ret==0)"
> 2. line 52: first call to mutex_lock
> 3. inner loop "while (list->head == list->tail)" does not change state 
> of mutex, because mutex_lock immediatelly follows mutex_unlock
> 4. if we go to the second iteration of "while(ret == 0)" in 
> line 50 then there are second call to mutex_lock in line 52 (mutex 
> aquired twice).
> 
> Second iteration of loop "while(ret==0)" is possible if local variable 
> ret is not changed at line 94: ret+=len - i.e. len==0;
> Variable len may be zero if hidraw_read is called with count==0 or 
> list->buffer[list->tail].len == 0.

Good catch. I will fix that up by moving the mutex_lock() so that it's 
locked before the loop is entered.

Thanks,

-- 
Jiri Kosina
SUSE Labs, Novell Inc.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/