lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 25 Jun 2020 17:36:47 +0800 From: Kent Gibson <warthog618@...il.com> To: Andy Shevchenko <andy.shevchenko@...il.com> Cc: Linux Kernel Mailing List <linux-kernel@...r.kernel.org>, "open list:GPIO SUBSYSTEM" <linux-gpio@...r.kernel.org>, Bartosz Golaszewski <bgolaszewski@...libre.com>, Linus Walleij <linus.walleij@...aro.org> Subject: Re: [PATCH 10/22] gpiolib: cdev: fix minor race in GET_LINEINFO_WATCH On Thu, Jun 25, 2020 at 12:23:49PM +0300, Andy Shevchenko wrote: > On Thu, Jun 25, 2020 at 12:13 PM Kent Gibson <warthog618@...il.com> wrote: > > On Thu, Jun 25, 2020 at 11:44:21AM +0300, Andy Shevchenko wrote: > > > On Thu, Jun 25, 2020 at 1:58 AM Kent Gibson <warthog618@...il.com> wrote: > > > > On Wed, Jun 24, 2020 at 11:57:14PM +0800, Kent Gibson wrote: > > ... > > > > > Perhaps you are referring to the case where the copy_to_user fails? > > > > > > Yes. > > > > > > > To be honest I considered that to be so unlikely that I ignored it. > > > > Is there a relevant failure mode that I'm missing? > > > > > > The traditional question for such cases is "what can possibly go wrong?" > > > I wouldn't underestimate the probability of failure. > > > > > > > The worst case is the watch is enabled and the userspace gets an > > EFAULT so it thinks it failed. If userspace retries then they get > > EBUSY, so userspace accounting gets muddled. > > > > We can clear the watch bit if the copy_to_user fails - before > > returning the EFAULT. Would that be satisfactory? > > Perhaps. I didn't check that scenario. > To be clear I'm suggesting this: gpio_desc_to_lineinfo(desc, &lineinfo); - if (copy_to_user(ip, &lineinfo, sizeof(lineinfo))) + if (copy_to_user(ip, &lineinfo, sizeof(lineinfo))) { + clear_bit(lineinfo.offset, gcdev->watched_lines); return -EFAULT; + } That undoes the set, returning the watch state to what it was before the call. Cheers, Kent.
Powered by blists - more mailing lists