linux-kernel - Re: [PATCH] tty: serial: owl: Fix data race in owl_uart

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ceebf511-9971-6deb-a6dd-458d69de2bbd@gmail.com>
Date:   Wed, 23 Jun 2021 11:06:53 +0530
From:   Saubhik Mukherjee <saubhik.mukherjee@...il.com>
To:     Greg KH <gregkh@...uxfoundation.org>
Cc:     jirislaby@...nel.org, linux-serial@...r.kernel.org,
        linux-kernel@...r.kernel.org, ldv-project@...uxtesting.org,
        andrianov@...ras.ru
Subject: Re: [PATCH] tty: serial: owl: Fix data race in owl_uart_remove

On 6/17/21 4:52 PM, Greg KH wrote:
> On Thu, Jun 17, 2021 at 04:34:43PM +0530, Saubhik Mukherjee wrote:
>> Suppose the driver is registered and a UART port is added. Once an
>> application opens the port, owl_uart_startup is called which registers
>> the interrupt handler owl_uart_irq.
>>
>> We could have the following race condition:
>>
>> When device is removed, owl_uart_remove is called, which calls
>> uart_remove_one_port, which calls owl_uart_release_port, which writes
>> NULL to port->membase. At this point parallely, an interrupt could be
>> handled by owl_uart_irq which reads port->membase.
>>
>> This is because it is possible to remove device without closing a port.
>> Thus, we need to check it and call owl_uart_shutdown in owl_uart_remove.
>>
>> Found by Linux Driver Verification project (linuxtesting.org).
>>
>> Signed-off-by: Saubhik Mukherjee <saubhik.mukherjee@...il.com>
>> ---
>>   drivers/tty/serial/owl-uart.c | 9 ++++++++-
>>   1 file changed, 8 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/tty/serial/owl-uart.c b/drivers/tty/serial/owl-uart.c
>> index 91f1eb0058d7..ac4e3aae2719 100644
>> --- a/drivers/tty/serial/owl-uart.c
>> +++ b/drivers/tty/serial/owl-uart.c
>> @@ -751,8 +751,15 @@ static int owl_uart_probe(struct platform_device *pdev)
>>   static int owl_uart_remove(struct platform_device *pdev)
>>   {
>>   	struct owl_uart_port *owl_port = platform_get_drvdata(pdev);
>> +	struct uart_port *port = &owl_port->port;
>>   
>> -	uart_remove_one_port(&owl_uart_driver, &owl_port->port);
>> +	/* It is possible to release device without closing a port.
>> +	 * Thus, need to check it and call shutdown.
>> +	 */
>> +	if (owl_uart_read(port, OWL_UART_CTL) & OWL_UART_CTL_EN)
>> +		owl_uart_shutdown(port);
> 
> How is this read determining if the device is here or not?  And what
> happens if the state change happens right _after_ the check?
> 
> Also, your comment style is for networking, not the rest of the kernel
> :)
Thank you for your comments. OWL_UART_CTL_EN is set during startup and 
cleared during shutdown. It is not used anywhere else. So, it is used to 
determine if the port is opened.

To avoid issue due to state change right after check, the patch is 
updated. A global mutex is used to avoid race between owl_uart_startup 
and owl_uart_remove. The port opened check is done inside owl_uart_shutdown.

Signed-off-by: Saubhik Mukherjee <saubhik.mukherjee@...il.com>
---
  drivers/tty/serial/owl-uart.c | 27 ++++++++++++++++++++++-----
  1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/drivers/tty/serial/owl-uart.c b/drivers/tty/serial/owl-uart.c
index 91f1eb0058d7..7a17f4637ea2 100644
--- a/drivers/tty/serial/owl-uart.c
+++ b/drivers/tty/serial/owl-uart.c
@@ -68,6 +68,8 @@

  static struct uart_driver owl_uart_driver;

+static DEFINE_MUTEX(owl_uart_mutex);  /* race between startup & remove */
+
  struct owl_uart_info {
  	unsigned int tx_fifosize;
  };
@@ -283,13 +285,19 @@ static void owl_uart_shutdown(struct uart_port *port)
  	spin_lock_irqsave(&port->lock, flags);

  	val = owl_uart_read(port, OWL_UART_CTL);
-	val &= ~(OWL_UART_CTL_TXIE | OWL_UART_CTL_RXIE
-		| OWL_UART_CTL_TXDE | OWL_UART_CTL_RXDE | OWL_UART_CTL_EN);
-	owl_uart_write(port, val, OWL_UART_CTL);

-	spin_unlock_irqrestore(&port->lock, flags);
+	/* Check if port is opened */
+	if (val & OWL_UART_CTL_EN) {
+		val &= ~(OWL_UART_CTL_TXIE | OWL_UART_CTL_RXIE
+			| OWL_UART_CTL_TXDE | OWL_UART_CTL_RXDE | OWL_UART_CTL_EN);
+		owl_uart_write(port, val, OWL_UART_CTL);
+
+		spin_unlock_irqrestore(&port->lock, flags);

-	free_irq(port->irq, port);
+		free_irq(port->irq, port);
+	} else {
+		spin_unlock_irqrestore(&port->lock, flags);
+	}
  }

  static int owl_uart_startup(struct uart_port *port)
@@ -298,6 +306,8 @@ static int owl_uart_startup(struct uart_port *port)
  	unsigned long flags;
  	int ret;

+	mutex_lock(&owl_uart_mutex);
+
  	ret = request_irq(port->irq, owl_uart_irq, IRQF_TRIGGER_HIGH,
  			"owl-uart", port);
  	if (ret)
@@ -317,6 +327,7 @@ static int owl_uart_startup(struct uart_port *port)

  	spin_unlock_irqrestore(&port->lock, flags);

+	mutex_unlock(&owl_uart_mutex);
  	return 0;
  }

@@ -752,10 +763,16 @@ static int owl_uart_remove(struct platform_device 
*pdev)
  {
  	struct owl_uart_port *owl_port = platform_get_drvdata(pdev);

+	mutex_lock(&owl_uart_mutex);
+
+	/* Avoid removing port without closing */
+	owl_uart_shutdown(&owl_port->port);
+
  	uart_remove_one_port(&owl_uart_driver, &owl_port->port);
  	owl_uart_ports[pdev->id] = NULL;
  	clk_disable_unprepare(owl_port->clk);

+	mutex_unlock(&owl_uart_mutex);
  	return 0;
  }

-- 
2.30.2