linux-kernel - Re: possible deadlock in mon_bin_vma

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 21 Nov 2019 10:46:51 -0600
From:   Pete Zaitcev <zaitcev@...hat.com>
To:     Alan Stern <stern@...land.harvard.edu>
Cc:     syzbot <syzbot+56f9673bb4cdcbeb0e92@...kaller.appspotmail.com>,
        <arnd@...db.de>, <gregkh@...uxfoundation.org>,
        <jrdr.linux@...il.com>, <keescook@...omium.org>,
        <kstewart@...uxfoundation.org>,
        Kernel development list <linux-kernel@...r.kernel.org>,
        USB list <linux-usb@...r.kernel.org>,
        <syzkaller-bugs@...glegroups.com>, <tglx@...utronix.de>,
        <viro@...iv.linux.org.uk>, zaitcev@...hat.com
Subject: Re: possible deadlock in mon_bin_vma_fault

On Thu, 21 Nov 2019 11:20:20 -0500 (EST)
Alan Stern <stern@...land.harvard.edu> wrote:

> On Thu, 21 Nov 2019, Pete Zaitcev wrote:
> 
> > Anyway... If you are looking at it too, what do you think about not using
> > any locks in mon_bin_vma_fault() at all? Isn't it valid? I think I tried
> > to be "safe", but it only uses things that are constants unless we're
> > opening and closing; a process cannot make page faults unless it has
> > some thing mapped; and that is only possible if device is open and stays
> > open. Can you find a hole in this reasoning?  
> 
> I think you're right.  But one thing concerns me: What happens if the 
> same buffer is mapped by more than one process?  Do you allow that?

Yes, we allow 2 processes reading from mmap in the same time.
They may miss events, but there should be no issue to the internal
consistency of any pointers in usbmon, and no crashes or deadlocks.
Also, we cannot prohibit that. Imagine a process that does open(),
mmap(), fork()/clone().

-- Pete