linux-kernel - cdev_del(), and when is it safe to free memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Tue, 5 Jan 2016 13:58:38 -0800
From:	Rajat Jain <rajatxjain@...il.com>
To:	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: cdev_del(), and when is it safe to free memory

Hi,

I'm trying to understand the cdev_del() behavior while the device is
continuously accessed from user space.

struct my_dev{
 ...
 struct cdev cdev;
}

struct file_operations fops {
 .open = fun_open,
 . read = fun_read,
 .mmap = fun_mmap,
 . release = fun_release,
}

fun_register()
{
    struct my_dev *md = kmalloc(sizeof(struct my_dev), ...);
    alloc_chrdev_region(&devnum,...);

    cdev_init(&md->cdev, fops);
    cdev_add(&md->cdev, devnum, 1)l
     ....
}

fun_unregister(struct my_dev * md)
{
    cdev_del(&md->cdev);
    unregister_chrdev_region(devnum,...)
    kfree(md);
}

My user space program does something like this:

fd = open("/dev/my_dev", O_RDWR);
ptr = mmap(fd,...);
while (1) {
    read(fd, buf, 1);
    printf("%x", *ptr);
    printf("%c", buf);

}
munmap(ptr,...);
close(fd);

My driver tries to do cdev_del() while user is continuously using the
character device node.

My questions:

1) If my driver calls cdev_del() while the above user space program is
running, does the cdev_del() wait for any pending calls (read() here)
to complete before returning?

2) Once cdev_del() returns, am I guaranteed that my file operations
will never be called again (even though user space is issuing calls)
and holding file references at that point?

3) Since the user space does not ever give up references to the
character device node file, what is cdev_del() behaviour here? After
it returns, can I kfree all memory? (Note that I may have mmapped
memory to user space via mmap). Also, am I correct in releasing the
chrdev_region irrespective of user space accessing it?

Thanks,

Rajat
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/