linux-kernel - RE: [PATCH] dmabuf: use spinlock to access dmabuf->name

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b686a288cff640acaea1111fed650b02@AcuMS.aculab.com>
Date:   Wed, 17 Jun 2020 08:21:28 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     'Charan Teja Kalla' <charante@...eaurora.org>,
        "Ruhl, Michael J" <michael.j.ruhl@...el.com>,
        Sumit Semwal <sumit.semwal@...aro.org>,
        "open list:DMA BUFFER SHARING FRAMEWORK" 
        <linux-media@...r.kernel.org>,
        "DRI mailing list" <dri-devel@...ts.freedesktop.org>
CC:     Linaro MM SIG <linaro-mm-sig@...ts.linaro.org>,
        "vinmenon@...eaurora.org" <vinmenon@...eaurora.org>,
        LKML <linux-kernel@...r.kernel.org>,
        "stable@...r.kernel.org" <stable@...r.kernel.org>
Subject: RE: [PATCH] dmabuf: use spinlock to access dmabuf->name

From: Charan Teja Kalla
> Sent: 17 June 2020 07:29
...
> >> If name is freed you will copy garbage, but the only way
> >> for that to happen is that _set_name or _release have to be called
> >> at just the right time.
> >>
> >> And the above would probably only be an issue if the set_name
> >> was called, so you will get NULL or a real name.
> 
> And there exists a use-after-free to avoid which requires the lock. Say
> that memcpy() in dmabuffs_dname is in progress and in parallel _set_name
> will free the same buffer that memcpy is operating on.

If the name is being looked at while the item is being freed
you almost certainly have much bigger problems that just
the name being a 'junk' pointer.

	David.

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)