linux-kernel - Re: [PATCH] staging: greybus: Convert timers to use timer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGXu5jJaReoppUddWDByw78+XPZbGmBf12Cp9tu_gZG-8Qb71Q@mail.gmail.com>
Date:   Tue, 24 Oct 2017 05:47:53 -0700
From:   Kees Cook <keescook@...omium.org>
To:     "Bryan O'Donoghue" <pure.logic@...us-software.ie>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Johan Hovold <johan@...nel.org>, Alex Elder <elder@...nel.org>,
        greybus-dev@...ts.linaro.org, devel@...verdev.osuosl.org,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] staging: greybus: Convert timers to use timer_setup()

On Tue, Oct 24, 2017 at 2:40 AM, Bryan O'Donoghue
<pure.logic@...us-software.ie> wrote:
> On 24/10/17 10:35, Bryan O'Donoghue wrote:
>>
>> On 24/10/17 09:25, Kees Cook wrote:
>>>
>>> In preparation for unconditionally passing the struct timer_list pointer
>>> to
>>> all timer callbacks, switch to using the new timer_setup() and
>>> from_timer()
>>> to pass the timer pointer explicitly.
>>>
>>> Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
>>> Cc: "Bryan O'Donoghue" <pure.logic@...us-software.ie>
>>> Cc: Johan Hovold <johan@...nel.org>
>>> Cc: Alex Elder <elder@...nel.org>
>>> Cc: greybus-dev@...ts.linaro.org
>>> Cc: devel@...verdev.osuosl.org
>>> Signed-off-by: Kees Cook <keescook@...omium.org>
>>> ---
>>>   drivers/staging/greybus/loopback.c  | 14 ++++----------
>>>   drivers/staging/greybus/operation.c |  7 +++----
>>>   2 files changed, 7 insertions(+), 14 deletions(-)
>>>
>>> diff --git a/drivers/staging/greybus/loopback.c
>>> b/drivers/staging/greybus/loopback.c
>>> index 08e255884206..045aaf81113a 100644
>>> --- a/drivers/staging/greybus/loopback.c
>>> +++ b/drivers/staging/greybus/loopback.c
>>> @@ -572,16 +572,11 @@ static void gb_loopback_async_operation_work(struct
>>> work_struct *work)
>>>       gb_loopback_async_operation_put(op_async);
>>>   }
>>> -static void gb_loopback_async_operation_timeout(unsigned long data)
>>> +static void gb_loopback_async_operation_timeout(struct timer_list *t)
>>>   {
>>> -    struct gb_loopback_async_operation *op_async;
>>> -    u16 id = data;
>>> +    struct gb_loopback_async_operation *op_async =
>>> +        from_timer(op_async, t, timer);
>>> -    op_async = gb_loopback_operation_find(id);
>>> -    if (!op_async) {
>>> -        pr_err("operation %d not found - time out ?\n", id);
>>> -        return;
>>> -    }
>>
>>
>> Hi Kees, you need to add
>>
>>      gb_loopback_async_operation_get(op_async); when dropping the
>> gb_loopback_operation_find() call here.
>
>
> Actually:
>
>         spin_lock_irqsave(&gb_dev.lock, flags);
>         gb_loopback_async_operation_get(op_async);
>         spin_unlock_irqrestore(&gb_dev.lock, flags);

Shouldn't the get/put follow the lifetime of the timer running
instead? It shouldnt' be possible to free the op_async while the timer
is still pending/running.

-Kees

-- 
Kees Cook
Pixel Security