linux-kernel - Re: [PATCH v3] char: pcmcia: cm4000_cs: Fix use-after-free in cm4000

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 22 Feb 2023 08:53:22 +0100
From:   Jiri Slaby <jirislaby@...nel.org>
To:     Arnd Bergmann <arnd@...db.de>, Hyunwoo Kim <imv4bel@...il.com>,
        Harald Welte <laforge@...monks.org>
Cc:     linux-kernel@...r.kernel.org,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Dominik Brodowski <linux@...inikbrodowski.net>
Subject: Re: [PATCH v3] char: pcmcia: cm4000_cs: Fix use-after-free in
 cm4000_fops

On 21. 02. 23, 13:43, Arnd Bergmann wrote:
> On Tue, Feb 21, 2023, at 07:51, Jiri Slaby wrote:
>> Ping -- what's the status of these?
>>
>> Should we mark cm4000_cs, cm4040_cs, and scr24x_cs as BROKEN instead?
> 
> A few bug fixes ago, I think we had all agreed that the drivers can
> just be removed immediately, without a grace period or going through
> drivers/staging [1]. We just need someone to send the corresponding
> patches.
> 
> While looking for those, I see that Dominik also asked the
> broader question about PCMCIA drivers in general [2] (sorry
> I missed that thread at the time), and Linus just merged my
> boardfile removal patches that ended up dropping half of the
> (arm32) soc or board specific socket back end drivers.
> 
> Among the options that Dominik proposed in that email, I would
> prefer we go ahead with b) and remove most of the drivers that
> have no known users. I think we can be more aggressive though,
> as most of the drivers that are listed as 'some activity in
> 2020/21/22' seem to only be done to fix the same issues that
> were found in ISA or PCI drivers.

So let me start with removal of all (both + and -) listed[2] 
drivers/char/pcmcia/ drivers. That includes all three racy/buggy ones. 
And let's see what happens.

Personal not: this will also remove synclinc_cs \o/. Mostly only we, the 
tty people, were forced to touch the driver and I really hate it.

 > [2] 
https://lore.kernel.org/all/Y07d7rMvd5++85BJ@owl.dominikbrodowski.net/

thanks,
-- 
js
suse labs