linux-kernel - RE: [PATCH 2/5] vmbus: add driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CY4PR21MB0773F0CF5B7E3B4ED0F2BBF3DC380@CY4PR21MB0773.namprd21.prod.outlook.com>
Date:   Tue, 14 Aug 2018 19:13:13 +0000
From:   "Michael Kelley (EOSG)" <Michael.H.Kelley@...rosoft.com>
To:     Stephen Hemminger <stephen@...workplumber.org>
CC:     KY Srinivasan <kys@...rosoft.com>,
        "gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "devel@...uxdriverproject.org" <devel@...uxdriverproject.org>,
        "olaf@...fle.de" <olaf@...fle.de>,
        "apw@...onical.com" <apw@...onical.com>,
        "jasowang@...hat.com" <jasowang@...hat.com>,
        Stephen Hemminger <sthemmin@...rosoft.com>,
        vkuznets <vkuznets@...hat.com>
Subject: RE: [PATCH 2/5] vmbus: add driver_override support

From: Stephen Hemminger <stephen@...workplumber.org>  Sent: Tuesday, August 14, 2018 9:35 AM

> On Mon, 13 Aug 2018 19:30:50 +0000
> "Michael Kelley (EOSG)" <Michael.H.Kelley@...rosoft.com> wrote:
> 
> > > +/*
> > > + * Return a matching hv_vmbus_device_id pointer.
> > > + * If there is no match, return NULL.
> > > + */
> > > +static const struct hv_vmbus_device_id *hv_vmbus_get_id(struct hv_driver *drv,
> > > +							struct hv_device *dev)
> > > +{
> > > +	const uuid_le *guid = &dev->dev_type;
> > > +	const struct hv_vmbus_device_id *id;
> > >
> > > -	return NULL;
> > > +	/* When driver_override is set, only bind to the matching driver */
> > > +	if (dev->driver_override && strcmp(dev->driver_override, drv->name))
> > > +		return NULL;
> >
> > This function needs to be covered by the device lock, so that
> > dev->driver_override can't be set to NULL and the memory freed
> > during the above 'if' statement.  When called from vmbus_probe(),
> > the device lock is held, so it's good. But when called from
> > vmbus_match(), the device lock may not be held: consider the path
> > __driver_attach() -> driver_match_device() -> vmbus_match().
> 
> The function hv_vmbus_get_id is called from that path.
> i.e. __device_attach -> driver-match_device -> vmbus_match.
> and __device_attach always does:
> 	device_lock(dev);

Agreed.  The __device_attach() path holds the device lock and all is good.
But the __driver_attach() path does not hold the device lock when the
match function is called, leaving the code open to a potential race.  Same
problem could happen in the pci subsystem, so the issue is more generic
and probably should be evaluated and dealt with separately.

Michael

> 
> The code in driver _override_store uses the same device_lock
> when storing the new value.
> 
> This is same locking as is done in pci-sysfs.c