linux-kernel - Re: [RFC v3 1/1] Input: Add userio module

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 22 Jul 2015 14:39:59 -0700
From:	Dmitry Torokhov <dmitry.torokhov@...il.com>
To:	Stephen Chandler Paul <cpaul@...hat.com>
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	Mauro Carvalho Chehab <mchehab@....samsung.com>,
	Greg KH <gregkh@...uxfoundation.org>,
	Arnd Bergmann <arnd@...db.de>, Joe Perches <joe@...ches.com>,
	Jiri Slaby <jslaby@...e.com>,
	Vishnu Patekar <vishnupatekar0510@...il.com>,
	Sebastian Ott <sebott@...ux.vnet.ibm.com>,
	linux-doc@...r.kernel.org, linux-kernel@...r.kernel.org,
	linux-input@...r.kernel.org, linux-api@...r.kernel.org,
	Benjamin Tissoires <benjamin.tissoires@...hat.com>,
	Hans de Goede <hdegoede@...hat.com>
Subject: Re: [RFC v3 1/1] Input: Add userio module

Hi Stephen,

On Wed, Jul 22, 2015 at 03:52:53PM -0400, Stephen Chandler Paul wrote:
> +static int userio_char_open(struct inode *inode, struct file *file)
> +{
> +	struct userio_device *userio;
> +
> +	userio = devm_kzalloc(userio_misc.this_device,
> +			      sizeof(struct userio_device), GFP_KERNEL);
> +	if (!userio)
> +		return -ENOMEM;

Never ever use devm_ API outside of device probe() calls because
devm-managed resources only freed after failed probe() or after remove()
callback on driver model device and not any other device (block, char,
etc) in the system.

> +
> +	spin_lock_init(&userio->head_lock);
> +	mutex_init(&userio->tail_lock);
> +	init_waitqueue_head(&userio->waitq);
> +
> +	userio->serio = kzalloc(sizeof(struct serio), GFP_KERNEL);
> +	if (!userio->serio) {
> +		devm_kfree(userio_misc.this_device, userio);

And indeed here you have ot manually release the acquired resource. So
the only benefit you got form devm* is wasted resousrces.

> +		return -ENOMEM;
> +	}
> +
> +	userio->serio->write = userio_device_write;
> +	userio->serio->port_data = userio;
> +
> +	file->private_data = userio;
> +
> +	return 0;
> +}
> +
> +static int userio_char_release(struct inode *inode, struct file *file)
> +{
> +	struct userio_device *userio = file->private_data;
> +
> +	if (userio->serio) {
> +		userio->serio->port_data = NULL;

No need to reset, it is going away.

> +
> +		if (userio->running)
> +			serio_unregister_port(userio->serio);
> +		else
> +			kfree(userio->serio);
> +	}
> +
> +	devm_kfree(userio_misc.this_device, userio);
> +
> +	return 0;
> +}
> +
> +static ssize_t userio_char_read(struct file *file, char __user *buffer,
> +				size_t count, loff_t *ppos)
> +{
> +	struct userio_device *userio = file->private_data;
> +	int ret;
> +	size_t nonwrap_len, copylen;
> +
> +	if (!count)
> +		return 0;
> +
> +	if (file->f_flags & O_NONBLOCK && userio->head == userio->tail)
> +		return -EAGAIN;
> +	else {

This is racy. If there was data and other thread "stole" it here then
your O_NONBLOCK will block. See evdev_read() how you supposed to handle
this.

Thanks.

-- 
Dmitry
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/