linux-kernel - [PATCH 1/2] memrar: Address kernel oops during resource cleanup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100719083212.7357.28472.stgit@localhost.localdomain>
Date:	Mon, 19 Jul 2010 09:32:26 +0100
From:	Alan Cox <alan@...ux.intel.com>
To:	greg@...ah.com, linux-kernel@...r.kernel.org
Subject: [PATCH 1/2] memrar: Address kernel oops during resource cleanup

From: Ossama Othman <ossama.othman@...el.com>

Some delayed initialization is performed in this driver.  Make sure
resources that are used during driver clean-up (e.g. during driver's
release() function) are fully initialized before first use.  This is
particularly important for the case when the delayed initialization
isn't completed, leaving behind a partially initialized driver.

Such a scenario can occur when RAR is not available on the platform,
and the driver is release()d.

Signed-off-by: Ossama Othman <ossama.othman@...el.com>
Signed-off-by: Alan Cox <alan@...ux.intel.com>
---

 drivers/staging/memrar/memrar_handler.c |   28 +++++++++++++++++++---------
 1 files changed, 19 insertions(+), 9 deletions(-)


diff --git a/drivers/staging/memrar/memrar_handler.c b/drivers/staging/memrar/memrar_handler.c
index 5fe6028..a98b3f1 100644
--- a/drivers/staging/memrar/memrar_handler.c
+++ b/drivers/staging/memrar/memrar_handler.c
@@ -278,15 +278,6 @@ static int memrar_init_rar_resources(int rarnum, char const *devname)
 	BUG_ON(!memrar_is_valid_rar_type(rarnum));
 	BUG_ON(rar->allocated);
 
-	mutex_init(&rar->lock);
-
-	/*
-	 * Initialize the process table before we reach any
-	 * code that exit on failure since the finalization
-	 * code requires an initialized list.
-	 */
-	INIT_LIST_HEAD(&rar->buffers.list);
-
 	if (rar_get_address(rarnum, &low, &high) != 0)
 		/* No RAR is available. */
 		return -ENODEV;
@@ -940,9 +931,28 @@ static int memrar_registration_callback(unsigned long rar)
 static int __init memrar_init(void)
 {
 	int err;
+	int i;
 
 	printk(banner);
 
+	/*
+	 * Some delayed initialization is performed in this driver.
+	 * Make sure resources that are used during driver clean-up
+	 * (e.g. during driver's release() function) are fully
+	 * initialized before first use.  This is particularly
+	 * important for the case when the delayed initialization
+	 * isn't completed, leaving behind a partially initialized
+	 * driver.
+	 *
+	 * Such a scenario can occur when RAR is not available on the
+	 * platform, and the driver is release()d.
+	 */
+	for (i = 0; i != ARRAY_SIZE(memrars); ++i) {
+		struct memrar_rar_info * const rar = &memrars[i];
+		mutex_init(&rar->lock);
+		INIT_LIST_HEAD(&rar->buffers.list);
+	}
+
 	err = misc_register(&memrar_miscdev);
 	if (err)
 		return err;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/