linux-kernel - Re: [PATCH 10/22] gpiolib: cdev: fix minor race in GET_LINEINFO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHp75VdCGpvoK8RZGwbehOd3eORE+qwFR31ucFxtU4vdc5pvYg@mail.gmail.com>
Date:   Thu, 25 Jun 2020 11:44:21 +0300
From:   Andy Shevchenko <andy.shevchenko@...il.com>
To:     Kent Gibson <warthog618@...il.com>
Cc:     Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        "open list:GPIO SUBSYSTEM" <linux-gpio@...r.kernel.org>,
        Bartosz Golaszewski <bgolaszewski@...libre.com>,
        Linus Walleij <linus.walleij@...aro.org>
Subject: Re: [PATCH 10/22] gpiolib: cdev: fix minor race in GET_LINEINFO_WATCH

On Thu, Jun 25, 2020 at 1:58 AM Kent Gibson <warthog618@...il.com> wrote:
> On Wed, Jun 24, 2020 at 11:57:14PM +0800, Kent Gibson wrote:
> > On Wed, Jun 24, 2020 at 05:46:33PM +0300, Andy Shevchenko wrote:
> > > On Tue, Jun 23, 2020 at 7:03 AM Kent Gibson <warthog618@...il.com> wrote:

...

> > > I stumbled over this myself, but...
> > >
> > > > -               if (test_bit(hwgpio, gcdev->watched_lines))
> > > > +               if (test_and_set_bit(hwgpio, gcdev->watched_lines))
> > > >                         return -EBUSY;
> > > >
> > > >                 gpio_desc_to_lineinfo(desc, &lineinfo);
> > > > @@ -897,7 +897,6 @@ static long gpio_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
> > > >                 if (copy_to_user(ip, &lineinfo, sizeof(lineinfo)))
> > > >                         return -EFAULT;
> > > >
> > > > -               set_bit(hwgpio, gcdev->watched_lines);
> > > >                 return 0;
> > >
> > > ...I think it's not an equivalent despite races involved. If you set
> > > bit and return error code, you will have the wrong state.

> Perhaps you are referring to the case where the copy_to_user fails?

Yes.

> To be honest I considered that to be so unlikely that I ignored it.
> Is there a relevant failure mode that I'm missing?

The traditional question for such cases is "what can possibly go wrong?"
I wouldn't underestimate the probability of failure.


-- 
With Best Regards,
Andy Shevchenko