linux-kernel - Re: [PATCH v5 5/5] firmware: imx: adds miscdev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZpUAQ0QDr9kzlOIn@pengutronix.de>
Date: Mon, 15 Jul 2024 12:56:03 +0200
From: Sascha Hauer <s.hauer@...gutronix.de>
To: Frank Li <Frank.li@....com>
Cc: Pankaj Gupta <pankaj.gupta@....com>, Jonathan Corbet <corbet@....net>,
	Rob Herring <robh@...nel.org>,
	Krzysztof Kozlowski <krzk+dt@...nel.org>,
	Conor Dooley <conor+dt@...nel.org>, Shawn Guo <shawnguo@...nel.org>,
	Pengutronix Kernel Team <kernel@...gutronix.de>,
	Fabio Estevam <festevam@...il.com>,
	Rob Herring <robh+dt@...nel.org>, linux-doc@...r.kernel.org,
	linux-kernel@...r.kernel.org, devicetree@...r.kernel.org,
	imx@...ts.linux.dev, linux-arm-kernel@...ts.infradead.org
Subject: Re: [PATCH v5 5/5] firmware: imx: adds miscdev

Hi Frank,

On Fri, Jul 12, 2024 at 06:19:22PM -0400, Frank Li wrote:
> > +	rx_msg = kzalloc(cmd_snd_rcv_rsp_info.rx_buf_sz, GFP_KERNEL);
> > +	if (!rx_msg) {
> > +		err = -ENOMEM;
> > +		goto exit;
> > +	}
> > +
> > +	tx_msg = memdup_user(cmd_snd_rcv_rsp_info.tx_buf,
> > +			     cmd_snd_rcv_rsp_info.tx_buf_sz);
> > +	if (IS_ERR(tx_msg)) {
> > +		err = PTR_ERR(tx_msg);
> > +		goto exit;
> > +	}
> > +
> > +	if (tx_msg->header.tag != priv->cmd_tag) {
> > +		err = -EINVAL;
> > +		goto exit;
> > +	}
> > +
> > +	scoped_guard(mutex, &priv->se_if_cmd_lock);
> 
> You totally wrong use scoped_guard in whole patch.
> 
> fun()
> {
>      guard(); //which means lock here
>      ...
>      return; // unlock here
> }
> 
> scoped_guard()
> {     // lock here
>       ...
>       //unlock here
> }
> 
> your code scoped_guard(mutex, &priv->se_if_cmd_lock);
> is equal to
>  
>       mutex_lock();
>       mutex_unlock();
> 
> Nothing protected by mutex lock at all.

Thanks for bringing this on the table again. I already mourned about
this in v2 of this series, but didn't notice the issue wasn't fixed
then.

Sascha

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |