linux-kernel - Re: [PATCH] Driver core: fix race in dev_driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 4 Dec 2009 22:58:48 +0100
From:	Oliver Neukum <oliver@...kum.org>
To:	Alan Stern <stern@...land.harvard.edu>
Cc:	Greg KH <gregkh@...e.de>, stable@...nel.org,
	Rickard Bellini <rickard.bellini@...csson.com>,
	"linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
	Torgny Johansson <torgny.johansson@...csson.com>,
	Kernel development list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] Driver core: fix race in dev_driver_string

Am Freitag, 4. Dezember 2009 22:36:22 schrieb Alan Stern:
> > > Typically the driver would take a reference during open() and drop it
> > > during close().
> >
> > 
> > You can do that but then you must not do IO prior to open() or after
> > close(). That is you must actually wait for IO to finish in close() and
> > cannot prefill your buffers before open().
> 
> If open() or close() is called before disconnect() then you don't have 
> to worry.
> 
> If close() is called after disconnect() there's nothing to wait for, 
> because disconnect() should call usb_kill_urb() on all outstanding 
> transfers (actually usbcore will do that for you).  Likewise with 
> open().
> 
> The problem in this example stems from the fact that you are using
> instance->dev at a time when you don't know that it is valid -- in
> fact, you have good reason to believe it _isn't_ valid because
> instance->disconnected is set.

OK, yes. It's a bad example. However this is tricky.

This is a bug then:

mutex_lock(...);

if (instance->error) {
	rv = instance->error;
	instance->error  = 0;
	dev_dbg(instance->dev,...);
	goto err_out;
}

rv = -ENODEV;
if (instance->disconnected)
	goto err_out;

> One approach is to set instance->dev to NULL in disconnect().  That
> wouldn't do much good for your dev_dbg(), though.  A better solution is
> to refcount the instance->dev pointer: Take a reference to the device
> when setting instance->dev and drop it when clearing instance->dev (or
> when instance is freed).

That would mean that I am forced to adopt refcounting just to print
something. This seems very inelegant.

	Regards
		Oliver
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/