linux-kernel - Re: [PATCH v2] uio: Fix uio driver to refcount device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5509B0EC.8030604@brocade.com>
Date:	Wed, 18 Mar 2015 17:07:56 +0000
From:	Brian Russell <brian.russell@...cade.com>
To:	"Hans J. Koch" <hjk@...sjkoch.de>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
CC:	<linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2] uio: Fix uio driver to refcount device

Responding to myself ...

On 13/03/15 10:17, Brian Russell wrote:
> Protect uio driver from crashing if its owner is hot unplugged while there
> are open fds.
> 
> Signed-off-by: Brian Russell <brussell@...cade.com>
> ---
>  drivers/uio/uio.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
> index 6276f13..70ce015 100644
> --- a/drivers/uio/uio.c
> +++ b/drivers/uio/uio.c
> @@ -434,9 +434,11 @@ static int uio_open(struct inode *inode, struct file *filep)
>  		goto out;
>  	}
>  
> +	get_device(idev);
> +

This is bogus, idev is uio_device *, not device *. Turns out this patch only masked the crash I was seeing, so please ignore. Updated version to follow ...

Thanks,

Brian

>  	if (!try_module_get(idev->owner)) {
>  		ret = -ENODEV;
> -		goto out;
> +		goto err_module_get;
>  	}
>  
>  	listener = kmalloc(sizeof(*listener), GFP_KERNEL);
> @@ -462,6 +464,9 @@ err_infoopen:
>  err_alloc_listener:
>  	module_put(idev->owner);
>  
> +err_module_get:
> +	put_device(idev);
> +
>  out:
>  	return ret;
>  }
> @@ -485,6 +490,7 @@ static int uio_release(struct inode *inode, struct file *filep)
>  
>  	module_put(idev->owner);
>  	kfree(listener);
> +	put_device(idev);
>  	return ret;
>  }
>  
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/