linux-kernel - RE: [PATCH] wifi: rtw89: wow: Add unlock mutex before to return

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <61b75a0d3b7047bb93c4abfa7de8c046@realtek.com>
Date: Fri, 4 Oct 2024 04:13:42 +0000
From: Ping-Ke Shih <pkshih@...ltek.com>
To: Alessandro Zanni <alessandro.zanni87@...il.com>,
        "kvalo@...nel.org"
	<kvalo@...nel.org>
CC: "linux-wireless@...r.kernel.org" <linux-wireless@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "skhan@...uxfoundation.org" <skhan@...uxfoundation.org>,
        "anupnewsmail@...il.com" <anupnewsmail@...il.com>
Subject: RE: [PATCH] wifi: rtw89: wow: Add unlock mutex before to return

Alessandro Zanni <alessandro.zanni87@...il.com> wrote:
> In error handling code for "ieee80211_gtk_rekey_add failed", release
> the mutex before to return.
> 
> Found with Coccinelle static analisys tool,
> script: https://coccinelle.gitlabpages.inria.fr/website/rules/mut.cocci
> 
> Signed-off-by: Alessandro Zanni <alessandro.zanni87@...il.com>
> ---
>  drivers/net/wireless/realtek/rtw89/wow.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/wireless/realtek/rtw89/wow.c b/drivers/net/wireless/realtek/rtw89/wow.c
> index 86e24e07780d..8045acb27cf9 100644
> --- a/drivers/net/wireless/realtek/rtw89/wow.c
> +++ b/drivers/net/wireless/realtek/rtw89/wow.c
> @@ -624,6 +624,7 @@ static struct ieee80211_key_conf *rtw89_wow_gtk_rekey(struct rtw89_dev *rtwdev,
>         kfree(rekey_conf);
>         if (IS_ERR(key)) {
>                 rtw89_err(rtwdev, "ieee80211_gtk_rekey_add failed\n");
> +               mutex_unlock(&rtwdev->mutex);
>                 return NULL;
>         }

The driver mutex is held across this function. Only unlock before calling 
ieee80211_gtk_rekey_add() and lock after that, because the function enters
driver again and lock mutex again causing deadlock. 

Thus this Coccinelle finding is false alarm. NACK this patch.