linux-kernel - Re: [PATCH v3] firmware_loader: fix use-after-free in firmware_fallback

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210423184033.GQ4332@42.do-not-panic.com>
Date:   Fri, 23 Apr 2021 18:40:33 +0000
From:   Luis Chamberlain <mcgrof@...nel.org>
To:     Shuah Khan <skhan@...uxfoundation.org>
Cc:     Anirudh Rayabharam <mail@...rudhrb.com>,
        Shuah Khan <shuah@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "Rafael J. Wysocki" <rafael@...nel.org>,
        Junyong Sun <sunjy516@...il.com>,
        syzbot+de271708674e2093097b@...kaller.appspotmail.com,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v3] firmware_loader: fix use-after-free in
 firmware_fallback_sysfs

On Wed, Apr 14, 2021 at 09:26:55AM -0600, Shuah Khan wrote:
> On 4/14/21 6:55 AM, Luis Chamberlain wrote:
> > In either case I documented well *why* we do these error checks
> > before sending a code to userspace on fw_sysfs_wait_timeout() since
> > otherwise it would be easy to regress that code, so please also
> > document that as I did.
> > 
> > I'll re-iterate again also:
> > 
> > 	Shuah's commit 0542ad88fbdd81bb ("firmware loader: Fix
> > 	_request_firmware_load() return val for fw load abort") also wanted to
> > 	distinguish the timeout vs -ENOMEM, but for some reason in the timeout
> > 	case -EAGAIN was being sent back to userspace. I am no longer sure if
> > 	that is a good idea, but since we started doing that at some point I
> > 	guess we want to keep that behaviour.
> > 
> > Shuah, can you think of any reason to retain -EAGAIN other than you
> > introduced it here? If there's no real good reason I think it can
> > simplify the error handling here. But, we *would* change what we do
> > to userspace... and for that reason we may have to live with it.
> > 
> 
> As I recall the reason for this patch was to be able to differentiate
> between timing out vs no memory case when driver was attempting to
> load firmware. I wish I added why to the change log.
> 
> The code seems to have changed a lot since my commit. I will take a look
> at the closely and let you know if this is still necessary late on
> today.

Shuah, *poke*

  Luis