linux-kernel - Re: [PATCH 1/4] rpmsg: ctrl: Introduce RPMSG_CREATE_DEV

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 21 Jun 2021 11:35:56 +0200
From:   Arnaud POULIQUEN <arnaud.pouliquen@...s.st.com>
To:     Mathieu Poirier <mathieu.poirier@...aro.org>
CC:     Bjorn Andersson <bjorn.andersson@...aro.org>,
        Ohad Ben-Cohen <ohad@...ery.com>,
        <linux-remoteproc@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <linux-stm32@...md-mailman.stormreply.com>
Subject: Re: [PATCH 1/4] rpmsg: ctrl: Introduce RPMSG_CREATE_DEV_IOCTL



On 6/16/21 10:12 AM, Arnaud POULIQUEN wrote:
> Hello Mathieu,
> 
> On 6/15/21 7:53 PM, Mathieu Poirier wrote:
>> On Fri, Jun 04, 2021 at 11:14:03AM +0200, Arnaud Pouliquen wrote:
>>> Implement the RPMSG_CREATE_DEV_IOCTL to allow the user application to
>>> initiate a communication through a new rpmsg channel.
>>> This Ioctl can be used to instantiate a local rpmsg device.
>>> Depending on the back-end implementation, the associated rpmsg driver is
>>> probed and a NS announcement can be sent to the remote processor.
>>>
>>> Suggested-by: Mathieu Poirier <mathieu.poirier@...aro.org>
>>> Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@...s.st.com>
>>> ---
>>>  drivers/rpmsg/rpmsg_ctrl.c | 30 ++++++++++++++++++++++++++----
>>>  include/uapi/linux/rpmsg.h |  5 +++++
>>>  2 files changed, 31 insertions(+), 4 deletions(-)
>>>
>>> diff --git a/drivers/rpmsg/rpmsg_ctrl.c b/drivers/rpmsg/rpmsg_ctrl.c
>>> index eeb1708548c1..4aa962df3661 100644
>>> --- a/drivers/rpmsg/rpmsg_ctrl.c
>>> +++ b/drivers/rpmsg/rpmsg_ctrl.c
>>> @@ -23,6 +23,7 @@
>>>  #include <uapi/linux/rpmsg.h>
>>>  
>>>  #include "rpmsg_char.h"
>>> +#include "rpmsg_internal.h"
>>>  
>>>  static dev_t rpmsg_major;
>>>  
>>> @@ -37,11 +38,13 @@ static DEFINE_IDA(rpmsg_minor_ida);
>>>   * @rpdev:	underlaying rpmsg device
>>>   * @cdev:	cdev for the ctrl device
>>>   * @dev:	device for the ctrl device
>>> + * @ctrl_lock:	serialize the ioctrls.
>>>   */
>>>  struct rpmsg_ctrldev {
>>>  	struct rpmsg_device *rpdev;
>>>  	struct cdev cdev;
>>>  	struct device dev;
>>> +	struct mutex ctrl_lock;
>>>  };
>>>  
>>>  static int rpmsg_ctrldev_open(struct inode *inode, struct file *filp)
>>> @@ -70,9 +73,8 @@ static long rpmsg_ctrldev_ioctl(struct file *fp, unsigned int cmd,
>>>  	void __user *argp = (void __user *)arg;
>>>  	struct rpmsg_endpoint_info eptinfo;
>>>  	struct rpmsg_channel_info chinfo;
>>> -
>>> -	if (cmd != RPMSG_CREATE_EPT_IOCTL)
>>> -		return -EINVAL;
>>> +	struct rpmsg_device *rpdev;
>>> +	int ret = 0;
>>>  
>>>  	if (copy_from_user(&eptinfo, argp, sizeof(eptinfo)))
>>>  		return -EFAULT;
>>> @@ -82,7 +84,26 @@ static long rpmsg_ctrldev_ioctl(struct file *fp, unsigned int cmd,
>>>  	chinfo.src = eptinfo.src;
>>>  	chinfo.dst = eptinfo.dst;
>>>  
>>> -	return rpmsg_chrdev_eptdev_create(ctrldev->rpdev, &ctrldev->dev, chinfo);
>>> +	mutex_lock(&ctrldev->ctrl_lock);
>>
>> Do we need a lock here?  I thought the character device layer would guarantee
>> accesses on a file handler would be atomic...  Am I wrong?
>>
> 
> It is a good point! from my understanding, using "unlocked_ioctl" ops, the
> driver has to handle is own atomic protection.
> I will try to hack the code to verify this.

I confirm without lock there is no atomic access, re-entrance is possible in
rpmsg_ctrldev_ioctl. Keeping lock to serialize the controls seems safer to me to
avoid race condition.

Regards
Arnaud

> 
> Thanks,
> Arnaud
> 
>>> +	switch (cmd) {
>>> +	case RPMSG_CREATE_EPT_IOCTL:
>>> +		ret = rpmsg_chrdev_eptdev_create(ctrldev->rpdev, &ctrldev->dev, chinfo);
>>> +		break;
>>> +
>>> +	case RPMSG_CREATE_DEV_IOCTL:
>>> +		rpdev = rpmsg_create_channel(ctrldev->rpdev, &chinfo);
>>> +		if (!rpdev) {
>>> +			dev_err(&ctrldev->dev, "failed to create %s channel\n", chinfo.name);
>>> +			ret = -ENXIO;
>>> +		}
>>> +		break;
>>> +
>>> +	default:
>>> +		ret = -EINVAL;
>>> +	}
>>> +	mutex_unlock(&ctrldev->ctrl_lock);
>>> +
>>> +	return ret;
>>>  };
>>>  
>>>  static const struct file_operations rpmsg_ctrldev_fops = {
>>> @@ -119,6 +140,7 @@ static int rpmsg_ctrldev_probe(struct rpmsg_device *rpdev)
>>>  	device_initialize(dev);
>>>  	dev->parent = &rpdev->dev;
>>>  
>>> +	mutex_init(&ctrldev->ctrl_lock);
>>>  	cdev_init(&ctrldev->cdev, &rpmsg_ctrldev_fops);
>>>  	ctrldev->cdev.owner = THIS_MODULE;
>>>  
>>> diff --git a/include/uapi/linux/rpmsg.h b/include/uapi/linux/rpmsg.h
>>> index f5ca8740f3fb..f9d5a74e7801 100644
>>> --- a/include/uapi/linux/rpmsg.h
>>> +++ b/include/uapi/linux/rpmsg.h
>>> @@ -33,4 +33,9 @@ struct rpmsg_endpoint_info {
>>>   */
>>>  #define RPMSG_DESTROY_EPT_IOCTL	_IO(0xb5, 0x2)
>>>  
>>> +/**
>>> + * Instantiate a rpmsg service device.
>>> + */
>>> +#define RPMSG_CREATE_DEV_IOCTL	_IOW(0xb5, 0x3, struct rpmsg_endpoint_info)
>>> +
>>>  #endif
>>> -- 
>>> 2.17.1
>>>