linux-kernel - Re: [PATCHv2] firmware: Correct handling of fw_state_wait

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170118200141.GH13946@wotan.suse.de>
Date:   Wed, 18 Jan 2017 21:01:41 +0100
From:   "Luis R. Rodriguez" <mcgrof@...nel.org>
To:     linux-kernel-dev <linux-kernel-dev@...khoff.com>
Cc:     Jakub Kicinski <jakub.kicinski@...ronome.com>,
        "Luis R. Rodriguez" <mcgrof@...nel.org>,
        Chris Wilson <chris@...is-wilson.co.uk>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Bjorn Andersson <bjorn.andersson@...aro.org>,
        Daniel Wagner <daniel.wagner@...-carit.de>,
        Ming Lei <ming.lei@...onical.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "oss-drivers@...ronome.com" <oss-drivers@...ronome.com>
Subject: Re: [PATCHv2] firmware: Correct handling of fw_state_wait_timeout()
 return value

On Wed, Jan 18, 2017 at 06:33:56AM +0000, linux-kernel-dev wrote:
> >From: Jakub Kicinski [mailto:jakub.kicinski@...ronome.com]
> >Sent: Dienstag, 17. Januar 2017 22:18
> >
> >On Tue, Jan 17, 2017 at 12:53 PM, Luis R. Rodriguez <mcgrof@...nel.org>
> >wrote:
> >> On Tue, Jan 17, 2017 at 10:04:20AM -0800, Jakub Kicinski wrote:
> >>> On Tue, Jan 17, 2017 at 9:30 AM, Luis R. Rodriguez <mcgrof@...nel.org>
> >wrote:
> >>> > On Tue, Jan 17, 2017 at 08:30:37AM -0800, Jakub Kicinski wrote:
> >>> >> Adding a NULL-check would just paper over the
> >>> >> issue and can cause trouble down the line.
> >>> >
> >>> > We typically bail on errors and use similar code to bail out, and we
> >>> > typically do these things. Here its no different. The *real* issue
> >>> > is the fact that we have a waiting timeout which can fail race against
> >>> > a user imposed error out on the sysfs interface. There is one catch:
> >>> >
> >>> > We already lock with the big fw_lock and use this to be able to check
> >>> > for the status of the fw, so once aborted we technically should not have
> >>> > to abort again. A proper way to address then this would have been to
> >check
> >>> > for the status of the fw prior to aborting again given we also lock on the
> >>> > big fw_lock. A problem with this though is the status is part of the buf
> >>> > which is set to NULL after we are done aborting.
> >>>
> >>> Yes, I've seen that too :\  This race seems to have been there prior
> >>> to 4.9, though.  I guess we could fix both issues with the NULL-check
> >>> although I would prefer if we had both patches.
> >>>
> >>> FWIW I think the NULL-check could be put in the existing conditional:
> >>>
> >>>          * There is a small window in which user can write to 'loading'
> >>>          * between loading done and disappearance of 'loading'
> >>>          */
> >>> -       if (fw_state_is_done(&buf->fw_st))
> >>> +       if (!buf || fw_state_is_done(&buf->fw_st))
> >>>                 return;
> >>>
> >>>         list_del_init(&buf->pending_list);
> >>>
> >>> Note that the comment above seems to be mentioning the race we're
> >>> trying to solve.
> >>
> >> Right, I think another approach is to *enable* the state of the buf
> >> to be used to avoid further use on the sysfs iterface instead. Fortunately
> >> other sysfs interfaces already use fw_state_is_done() to bail out,
> >> so all that would be needed I think would be:
> >>
> >> diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
> >> index b9ac348e8d33..30ccf7aea3ca 100644
> >> --- a/drivers/base/firmware_class.c
> >> +++ b/drivers/base/firmware_class.c
> >> @@ -558,9 +558,6 @@ static void fw_load_abort(struct firmware_priv
> >*fw_priv)
> >>         struct firmware_buf *buf = fw_priv->buf;
> >>
> >>         __fw_load_abort(buf);
> >> -
> >> -       /* avoid user action after loading abort */
> >> -       fw_priv->buf = NULL;
> >>  }
> >>
> >>  static LIST_HEAD(pending_fw_head);
> >> @@ -713,7 +710,7 @@ static ssize_t firmware_loading_store(struct device
> >*dev,
> >>
> >>         mutex_lock(&fw_lock);
> >>         fw_buf = fw_priv->buf;
> >> -       if (!fw_buf)
> >> +       if (!fw_buf || fw_state_is_aborted(&fw_buf->fw_st))
> >>                 goto out;
> >>
> >>         switch (loading) {
> >
> >IMHO this one is nice!  I think you can even drop the !fw_buf check in
> >this case because AFAICS the only case where fw_buf is set to NULL is
> >in the abort function.
> >
> I can confirm, that patch looks nice and is working for my setup, even without the !fw_buf. 
> Feel free to grab everything you need from my commit log, if it helps.
> Unfortunately there is a crazy spam filter between us, so you can't rely on me.

OK I'll submit this version with both your Reported-and-Tested-by.

  Luis