linux-kernel - Re: [PATCH resend ] tty/n_gsm.c: use gsm->num to remove mux itself from gsm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20151214154035.15ebb75a@lxorguk.ukuu.org.uk>
Date:	Mon, 14 Dec 2015 15:40:35 +0000
From:	One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>
To:	Pan Xinhui <xinhui.pan@...ux.vnet.ibm.com>
Cc:	linux-kernel@...r.kernel.org,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Jiri Slaby <jslaby@...e.com>, yanmin_zhang@...ux.intel.com,
	mnipxh@....com
Subject: Re: [PATCH resend ] tty/n_gsm.c: use gsm->num to remove mux itself
 from gsm_mux[]

On Mon, 14 Dec 2015 15:08:03 +0800
Pan Xinhui <xinhui.pan@...ux.vnet.ibm.com> wrote:

> From: Pan Xinhui <xinhui.pan@...ux.vnet.ibm.com>
> 
> There is one filed gsm->num to store mux's index of gsm_mux[]. So use
> gsm->num to remove itself from gsm_mux[] instead of the for-loop
> traverse in gsm_cleanup_mux().
> 
> Signed-off-by: Pan Xinhui <xinhui.pan@...ux.vnet.ibm.com>
> ---
>  drivers/tty/n_gsm.c |   14 +++++---------
>  1 files changed, 5 insertions(+), 9 deletions(-)
> 
> diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
> index 9aff371..cf28054 100644
> --- a/drivers/tty/n_gsm.c
> +++ b/drivers/tty/n_gsm.c
> @@ -2037,18 +2037,14 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm)
>  
>  	gsm->dead = 1;
>  
> -	spin_lock(&gsm_mux_lock);
> -	for (i = 0; i < MAX_MUX; i++) {
> -		if (gsm_mux[i] == gsm) {
> -			gsm_mux[i] = NULL;
> -			break;
> -		}
> -	}
> -	spin_unlock(&gsm_mux_lock);
>  	/* open failed before registering => nothing to do */
> -	if (i == MAX_MUX)
> +	if (gsm_mux[gsm->num] != gsm)
>  		return;
>  
> +	spin_lock(&gsm_mux_lock);
> +	gsm_mux[gsm->num] = NULL;
> +	spin_unlock(&gsm_mux_lock);

Its a highly theoretical and probably impossible corner case but I can't
help thinking the lock should be held for the if () as well as NULLing
this out.

Alan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/