linux-kernel - Re: [PATCH v2] platform/chrome: cros_ec_spi: Transfer messages at high priority

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190403183010.GR112750@google.com>
Date:   Wed, 3 Apr 2019 11:30:10 -0700
From:   Matthias Kaehlcke <mka@...omium.org>
To:     Doug Anderson <dianders@...omium.org>
Cc:     Brian Norris <briannorris@...omium.org>,
        Benson Leung <bleung@...omium.org>,
        Enric Balletbo i Serra <enric.balletbo@...labora.com>,
        Alexandru M Stan <amstan@...omium.org>,
        "open list:ARM/Rockchip SoC..." <linux-rockchip@...ts.infradead.org>,
        Simon Glass <sjg@...omium.org>,
        Guenter Roeck <groeck@...omium.org>,
        Mark Brown <broonie@...nel.org>,
        Ryan Case <ryandcase@...omium.org>,
        Randall Spangler <rspangler@...omium.org>,
        Heiko Stuebner <heiko@...ech.de>,
        Linux Kernel <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2] platform/chrome: cros_ec_spi: Transfer messages at
 high priority

On Wed, Apr 03, 2019 at 11:17:27AM -0700, Doug Anderson wrote:
> Hi,
> 
> On Wed, Apr 3, 2019 at 11:14 AM Matthias Kaehlcke <mka@...omium.org> wrote:
> > Each transfer has it's own work struct (allocated on the stack), hence
> > a) does not occur. b) is still true, but shouldn't be a problem on
> > its own.
> 
> Actually, it could be much worse _because_ it's on the stack.  The
> worker could write something back to the work after the work has been
> de-allocated.  That's bad.

Sure, I said "not a problem on its own."
                            ~~~~~~~~~~

The worker is owned by this driver and supposedly we know what we are
doing. Changing a member in the struct after calling complete() would
likely be a bug anyway (though not necessarily a fatal one).