linux-kernel - [PATCH v2] tty:synclink_gt unwind actions in error path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <dc4d3cba-0562-8a94-12f0-5c110bf6b10b@microgate.com>
Date:   Thu, 17 Nov 2022 19:09:36 -0800
From:   Paul Fulghum <paulkf@...rogate.com>
To:     Zhengchao Shao <shaozhengchao@...wei.com>,
        linux-kernel@...r.kernel.org, gregkh@...uxfoundation.org,
        jirislaby@...nel.org
Cc:     akpm@...ux-foundation.org, weiyongjun1@...wei.com,
        yuehaibing@...wei.com
Subject: [PATCH v2] tty:synclink_gt unwind actions in error path


synclink_gt.c:hdlcdev_open() does not properly
unwind actions in error path.

Unwound action 1: try_module_get(THIS_MODULE)

Change d4c63b7c7450 added try_module_get()/module_put()
to stop WARN_ON if modprobe -r removes synclink_gt while net
device is open. This is same as drivers/wan/farsync.c.
Other generic HDLC hardware drivers do not do this.
On unload, synclink_gt calls
drivers/wan/hdlc.c:unregister_hdlc_device()
which calls down to
net/sched/sch_generic.c:dev_shutdown() triggering
WARN_ON(timer_pending(&dev->watchdog_timer));
if net device is open.

try_module_get/module_put, a disfavored pattern, is replaced
by a call to dev_close() for open net device
before calling unregister_hdlc_device() when driver unloads.
This pevents WARN_ON.

Unwound action 2: drivers/wan/hdlc.c:hdlc_open()

This is moved to after driver level init/checks with proper
rollback of previous actions. This is a more sensible
ordering as the most common error paths are at the driver level
and the driver level rollbacks require less processing than
hdlc_open()/hdlc_close().

Fixes: d4c63b7c7450 ("synclink_gt fix module reference")
Fixes: 705b6c7b34f2 ("[PATCH] new driver synclink_gt")
Suggested-by: Zhengchao Shao <shaozhengchao@...wei.com>
Tested-by: Paul Fulghum <paulkf@...rogate.com>
Signed-off-by: Paul Fulghum <paulkf@...rogate.com>
---
V1 -> V2: improve description, add dev_close call

 drivers/tty/synclink_gt.c | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
index 25e9befdda3a..5921703f7228 100644
--- a/drivers/tty/synclink_gt.c
+++ b/drivers/tty/synclink_gt.c
@@ -70,6 +70,7 @@
 #include <linux/bitops.h>
 #include <linux/workqueue.h>
 #include <linux/hdlc.h>
+#include <linux/inetdevice.h>
 #include <linux/synclink.h>
 
 #include <asm/io.h>
@@ -1433,16 +1434,8 @@ static int hdlcdev_open(struct net_device *dev)
 	int rc;
 	unsigned long flags;
 
-	if (!try_module_get(THIS_MODULE))
-		return -EBUSY;
-
 	DBGINFO(("%s hdlcdev_open\n", dev->name));
 
-	/* generic HDLC layer open processing */
-	rc = hdlc_open(dev);
-	if (rc)
-		return rc;
-
 	/* arbitrate between network and tty opens */
 	spin_lock_irqsave(&info->netlock, flags);
 	if (info->port.count != 0 || info->netcount != 0) {
@@ -1461,6 +1454,16 @@ static int hdlcdev_open(struct net_device *dev)
 		return rc;
 	}
 
+	/* generic HDLC layer open processing */
+	rc = hdlc_open(dev);
+	if (rc) {
+		shutdown(info);
+		spin_lock_irqsave(&info->netlock, flags);
+		info->netcount = 0;
+		spin_unlock_irqrestore(&info->netlock, flags);
+		return rc;
+	}
+
 	/* assert RTS and DTR, apply hardware settings */
 	info->signals |= SerialSignal_RTS | SerialSignal_DTR;
 	program_hw(info);
@@ -1506,7 +1509,6 @@ static int hdlcdev_close(struct net_device *dev)
 	info->netcount=0;
 	spin_unlock_irqrestore(&info->netlock, flags);
 
-	module_put(THIS_MODULE);
 	return 0;
 }
 
@@ -1742,6 +1744,11 @@ static void hdlcdev_exit(struct slgt_info *info)
 {
 	if (!info->netdev)
 		return;
+	if (info->netcount) {
+		rtnl_lock();
+		dev_close(info->netdev);
+		rtnl_unlock();
+	}
 	unregister_hdlc_device(info->netdev);
 	free_netdev(info->netdev);
 	info->netdev = NULL;
-- 
2.34.1