linux-kernel - [PATCH] drivers: core: Make dev->driver usage safe in dev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240430045531.4062232-1-dirk.behme@de.bosch.com>
Date: Tue, 30 Apr 2024 06:55:31 +0200
From: Dirk Behme <dirk.behme@...bosch.com>
To: <linux-kernel@...r.kernel.org>, Greg Kroah-Hartman
	<gregkh@...uxfoundation.org>
CC: <dirk.behme@...bosch.com>, Rafael J Wysocki <rafael@...nel.org>,
	<syzbot+ffa8143439596313a85a@...kaller.appspotmail.com>, Eugeniu Rosca
	<eugeniu.rosca@...ch.com>
Subject: [PATCH] drivers: core: Make dev->driver usage safe in dev_uevent()

Inspired by the function dev_driver_string() in the same file make sure
in case of uninitialization dev->driver is used safely in dev_uevent(),
as well.

This change is based on the observation of the following race condition:

Thread #1:
==========

really_probe() {
..
probe_failed:
..
device_unbind_cleanup(dev) {
      ...
      dev->driver = NULL;   // <= Failed probe sets dev->driver to NULL
      ...
      }
..
}

Thread #2:
==========

dev_uevent() {
..
if (dev->driver)
      // If dev->driver is NULLed from really_probe() from here on,
      // after above check, the system crashes
      add_uevent_var(env, "DRIVER=%s", dev->driver->name);

dev_driver_string() can't be used here because we want NULL and not
anything else in the non-init case.

Similar cases are reported by syzkaller in

https://syzkaller.appspot.com/bug?extid=ffa8143439596313a85a

But these are regarding the *initialization* of dev->driver

dev->driver = drv;

As this switches dev->driver to non-NULL these reports can be considered
to be false-positives (which should be "fixed" by this commit, as well,
though).

Fixes: 239378f16aa1 ("Driver core: add uevent vars for devices of a class")
Cc: syzbot+ffa8143439596313a85a@...kaller.appspotmail.com
Reviewed-by: Eugeniu Rosca <eugeniu.rosca@...ch.com>
Tested-by: Eugeniu Rosca <eugeniu.rosca@...ch.com>
Signed-off-by: Dirk Behme <dirk.behme@...bosch.com>
---
 drivers/base/core.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/base/core.c b/drivers/base/core.c
index 5f4e03336e68..99ead727c08f 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -2639,6 +2639,7 @@ static const char *dev_uevent_name(const struct kobject *kobj)
 static int dev_uevent(const struct kobject *kobj, struct kobj_uevent_env *env)
 {
 	const struct device *dev = kobj_to_dev(kobj);
+	struct device_driver *drv;
 	int retval = 0;
 
 	/* add device node properties if present */
@@ -2667,8 +2668,12 @@ static int dev_uevent(const struct kobject *kobj, struct kobj_uevent_env *env)
 	if (dev->type && dev->type->name)
 		add_uevent_var(env, "DEVTYPE=%s", dev->type->name);
 
-	if (dev->driver)
-		add_uevent_var(env, "DRIVER=%s", dev->driver->name);
+	/* dev->driver can change to NULL underneath us because of unbinding
+	 * or failing probe(), so be careful about accessing it.
+	 */
+	drv = READ_ONCE(dev->driver);
+	if (drv)
+		add_uevent_var(env, "DRIVER=%s", drv->name);
 
 	/* Add common DT information about the device */
 	of_device_uevent(dev, env);
-- 
2.28.0