linux-kernel - Re: [PATCHv4 05/17] pps: access pps device by direct pointer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20101122180123.03690b6d@desktopvm.lvknet>
Date:	Mon, 22 Nov 2010 18:01:23 +0300
From:	Alexander Gordeev <lasaine@....cs.msu.su>
To:	Rodolfo Giometti <giometti@...eenne.com>
Cc:	linux-kernel@...r.kernel.org,
	"Nikita V. Youshchenko" <yoush@...msu.su>,
	linuxpps@...enneenne.com, Greg Kroah-Hartman <gregkh@...e.de>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Tejun Heo <tj@...nel.org>
Subject: Re: [PATCHv4 05/17] pps: access pps device by direct pointer

В Sun, 21 Nov 2010 09:26:58 +0100
Rodolfo Giometti <giometti@...eenne.com> пишет:

> On Sun, Nov 21, 2010 at 01:33:27AM +0300, Alexander Gordeev wrote:
> > > > -	if (ret < 0) {
> > > > +	if (pps == NULL) {
> > > >  		pr_err("cannot register PPS source \"%s\"\n", info.path);
> > > > -		return ret;
> > > > +		return -ENOMEM;
> > > >  	}
> > > > -	tty->disc_data = (void *)(long)ret;
> > > > +
> > > > +	spin_lock_irq(&pps_ldisc_lock);
> > > > +	tty->disc_data = pps;
> > > > +	spin_unlock_irq(&pps_ldisc_lock);
> > > 
> > > Maybe this lock is useless... however, are we sure that before setting
> > > tty->disc_data to pps its value is null? Otherwise the dcd_change may
> > > be called with an oops! We cannot control serial port IRQ
> > > generation... :-/
> > 
> > No, locking here is necessary.
> > There is only one problem this spinlock protects us from: current tty
> > code neither disables interrupts nor doesn't ensure there are no
> > references to PPS ldisc from uart_handle_dcd_change() before closing it
> > (and removing PPS source). It relies on flushing workqueue and disabling
> > input. It worked good this way until dcd_change() was added which
> > doesn't use workqueues and is called in atomic context so can't lock
> > on mutex.
> > 
> > Imagine that (on SMP system) uart_handle_dcd_change() could obtain a
> > reference to ldisc and call dcd_change() until actually calling
> > pps_event(); then on another processor all the path from
> > tty_ldisc_halt() until tty_ldisc_stop() is executed. And then
> > pps_event() is called with illegal pps pointer.
> > 
> > I just thought you are right that disc_data can be set not NULL by
> > another ldisc and it's a problem. But actually I just realised how to
> > fix it completely. :)
> > 
> > I just have to add a spinlock to tty_struct, lock all the
> > uart_handle_dcd_change() with it and add a "barrier" between
> > tty_ldisc_halt() and tty_ldisc_close() i.e. just that:
> > 
> > ...
> > spin_lock_irq();
> > spin_unlock_irq();
> > ...
> > 
> > This "barrier" will ensure that there is no references to ldisc from
> > uart_handle_dcd_change(). It won't be able to obtain a new reference
> > after tty_ldisc_halt() so will become completely sane. Not disabling
> > interrupts won't be a problem because it won't be able to obtain an
> > ldisc reference until tty_ldisc_enable() which is called only after the
> > new ldisc is fully functional. If it's our ldisc than it will have both
> > dcd_change defined and a valid pps pointer. If it's not our ldisc it
> > won't have both so uart_handle_dcd_change() won't call dcd_change() at
> > all.
> > 
> > I think I'll do that as a separate patch.
> 
> Excuse me but IMHO you should solve all your problems if you do the lock into
> pps_tty_init/cleanup instead of into pps_tty_open/close.
> 
>    spin_lock_irq();
>            err = tty_register_ldisc(N_PPS, &pps_ldisc_ops);
>            if (err)
>                    pr_err("can't register PPS line discipline\n");
>            else
>                    pr_info("PPS line discipline registered\n");
>    spin_unlock_irq();
> 
> And the same into cleanup.

Sorry, I don't understand how this is supposed to help. Anyway, a new
patch is underway.

-- 
  Alexander

Download attachment "signature.asc" of type "application/pgp-signature" (491 bytes)