linux-kernel - Re: [PATCH] xen-pciback: fix up cleanup path when alloc fails

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <565E0909.2010009@cardoe.com>
Date:	Tue, 1 Dec 2015 14:54:33 -0600
From:	Doug Goldstein <cardoe@...doe.com>
To:	Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>
Cc:	xen-devel@...ts.xenproject.org, linux-kernel@...r.kernel.org,
	Bob Liu <bob.liu@...cle.com>,
	Paul Durrant <paul.durrant@...rix.com>,
	Wei Liu <wei.liu2@...rix.com>,
	David Vrabel <david.vrabel@...rix.com>,
	Boris Ostrovsky <boris.ostrovsky@...cle.com>,
	Jonathan Creekmore <jonathan.creekmore@...il.com>
Subject: Re: [PATCH] xen-pciback: fix up cleanup path when alloc fails

On 12/1/15 1:35 PM, Konrad Rzeszutek Wilk wrote:
> On Tue, Dec 01, 2015 at 11:47:17AM -0500, Konrad Rzeszutek Wilk wrote:
>> On Thu, Nov 26, 2015 at 02:32:39PM -0600, Doug Goldstein wrote:
>>> When allocating a pciback device fails, avoid the possibility of a
>>> use after free.
>>
>> Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>
>>
>> Ugh, and it looks like xen-blkfront has the same issue.
> 
> <whew> Nope. No problems there.
> 
> The ->probe if it fails (so xenbus_dev_probe returns the error)
> ends up in the 'probe_failed' label in really_probe which takes care by doing:
> 
> dev_set_drvdata(dev, NULL);
> 
> Wheew!
> 
> either way the patch should go in, but the 'possibility' should
> be perhaps removed? Unless there is some other path I missed?

I put 'possibility' in there because it will only happen when the
function returns failure. I was also trying to not make it sound panicky
I guess. I can resubmit the patch with that word dropped if that's
desirable.

> 
>>
>>>
>>> Reported-by: Jonathan Creekmore <jonathan.creekmore@...il.com>
>>> Signed-off-by: Doug Goldstein <cardoe@...doe.com>
>>> ---
>>>  drivers/xen/xen-pciback/xenbus.c | 4 +++-
>>>  1 file changed, 3 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/xen/xen-pciback/xenbus.c b/drivers/xen/xen-pciback/xenbus.c
>>> index 98bc345..4843741 100644
>>> --- a/drivers/xen/xen-pciback/xenbus.c
>>> +++ b/drivers/xen/xen-pciback/xenbus.c
>>> @@ -44,7 +44,6 @@ static struct xen_pcibk_device *alloc_pdev(struct xenbus_device *xdev)
>>>  	dev_dbg(&xdev->dev, "allocated pdev @ 0x%p\n", pdev);
>>>  
>>>  	pdev->xdev = xdev;
>>> -	dev_set_drvdata(&xdev->dev, pdev);
>>>  
>>>  	mutex_init(&pdev->dev_lock);
>>>  
>>> @@ -58,6 +57,9 @@ static struct xen_pcibk_device *alloc_pdev(struct xenbus_device *xdev)
>>>  		kfree(pdev);
>>>  		pdev = NULL;
>>>  	}
>>> +
>>> +	dev_set_drvdata(&xdev->dev, pdev);
>>> +
>>>  out:
>>>  	return pdev;
>>>  }
>>> -- 
>>> 2.4.10
>>>


-- 
Doug Goldstein


Download attachment "signature.asc" of type "application/pgp-signature" (960 bytes)