linux-kernel - Re: Incorrect uses of get_driver()/put

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LFD.2.02.1201101114300.1750@c4eb>
Date:	Tue, 10 Jan 2012 11:18:13 +0100 (CET)
From:	Sebastian Ott <sebott@...ux.vnet.ibm.com>
To:	Dmitry Torokhov <dmitry.torokhov@...il.com>
cc:	Martin Schwidefsky <schwidefsky@...ibm.com>,
	Alan Stern <stern@...land.harvard.edu>,
	Joerg Roedel <joerg.roedel@....com>,
	Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>,
	Michael Buesch <m@...s.ch>,
	Kernel development list <linux-kernel@...r.kernel.org>
Subject: Re: Incorrect uses of get_driver()/put_driver()

On Tue, 10 Jan 2012, Dmitry Torokhov wrote:
> On Tue, Jan 10, 2012 at 10:05:41AM +0100, Martin Schwidefsky wrote:
> > On Mon, 9 Jan 2012 12:35:09 -0500 (EST)
> > Alan Stern <stern@...land.harvard.edu> wrote:
> > 
> > > drivers/s390/cio/device.c:1681:       drv = get_driver(&cdrv->driver);
> > > drivers/s390/cio/device.c:1687:       put_driver(drv);
> > > 
> > > Martin, these calls seem to be useless.  The calls in ccwgroup.c are 
> > > definitely useless; there's no reason to take a reference to a driver 
> > > while it's being unregistered, since it can't go away until the 
> > > unregistration is finished.
> > 
> > The get_driver/put_driver in ccwgroup.c are obviously useless, the caller
> > passed ccwgroup_driver_unregister a ccwgroup_driver reference.
> > I am not so sure about the code in device.c. get_ccwdev_by_busid() gets
> > used e.g. by vmur like this:
> 
> It does not matter how it is being used. Either get_ccwdev_by_busid()
> gets a valid driver structure or you already lost. You can not say that
> get_driver() protects anything, since if there is a chance driver can
> disappear it can disappear before we get to executing get_driver() code.
> 
> So while you might want to audit callers get/put_driver inside of
> get_ccwdev_by_busid() is utterly useless.

Yes, the caller has to ensure valid driver pointers. We have one offender
here:

[PATCH] zfcp: fops add owner

Set the owner member of zfcp_cfdc_fops, to ensure that the
caller of these functions holds a module reference.

Signed-off-by: Sebastian Ott <sebott@...ux.vnet.ibm.com>
---
 drivers/s390/scsi/zfcp_cfdc.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/s390/scsi/zfcp_cfdc.c
+++ b/drivers/s390/scsi/zfcp_cfdc.c
@@ -13,6 +13,7 @@
 
 #include <linux/slab.h>
 #include <linux/types.h>
+#include <linux/module.h>
 #include <linux/miscdevice.h>
 #include <asm/compat.h>
 #include <asm/ccwdev.h>
@@ -249,6 +250,7 @@ static long zfcp_cfdc_dev_ioctl(struct f
 }
 
 static const struct file_operations zfcp_cfdc_fops = {
+	.owner = THIS_MODULE,
 	.open = nonseekable_open,
 	.unlocked_ioctl = zfcp_cfdc_dev_ioctl,
 #ifdef CONFIG_COMPAT



> 
> Thanks.
> 
> -- 
> Dmitry
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
> 
> 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/