linux-kernel - BUG mutex_unlock without mutex_lock in drivers/pnp/isapnp/core.c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <201003011559.40139.strakh@ispras.ru>
Date:	Mon, 1 Mar 2010 15:59:40 +0000
From:	Alexander Strakh <strakh@...ras.ru>
To:	Jaroslav Kysela <perex@...ex.cz>
Cc:	Adam Belay <abelay@....edu>, Bjorn Helgaas <bjorn.helgaas@...com>,
	linux-kernel@...r.kernel.org
Subject: BUG mutex_unlock without mutex_lock in drivers/pnp/isapnp/core.c

	KERNEL_VERSION: 2.6.33
	SUBJECT: mutex_unlock without mutex_lock
	DESCRIBE:
	In drivers/pnp/isapnp/core.c in function isapnp_get_resources:

 1. In line 906 we call isapnp_cfg_begin(dev->card->number, dev->number);

 900 static int isapnp_get_resources(struct pnp_dev *dev)
 901 {
 902         int i, ret;
 903
 904         pnp_dbg(&dev->dev, "get resources\n");
 905         pnp_init_resources(dev);
 906         isapnp_cfg_begin(dev->card->number, dev->number);
...

2. If csn<1 or csn > isapnp_csn_count or logdev > 10 then function returns -
EINVAL and does not call mutex_lock.

 856 int isapnp_cfg_begin(int csn, int logdev)
 857 {
 858         if (csn < 1 || csn > isapnp_csn_count || logdev > 10)
 859                 return -EINVAL;
 860         mutex_lock(&isapnp_cfg_mutex);
...

3. Suppose function isapnp_read_bytes returned a null value. In this case we 
goto line 932 and call isapnp_cfg_end.

 907         dev->active = isapnp_read_byte(ISAPNP_CFG_ACTIVATE);
 908         if (!dev->active)
 909                 goto __end;
...
 932 __end:
 933         isapnp_cfg_end();
 934         return 0;
 935 }

4. isapnp_cfg_end in line  886 calls mutex_unlock on &isapnp_cfg_mutex without 
mutex_lock (it was not locked in function isapnp_cfg_begin because of -
EINVAL).

 883 int isapnp_cfg_end(void)
 884 {
 885         isapnp_wait();
 886         mutex_unlock(&isapnp_cfg_mutex);
 887         return 0;
 888 }

Found by Linux Device Drivers Verification Project
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/