linux-kernel - Re: [PATCH v5 5/7] revocable: Add fops replacement

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20251107141209.GJ1732817@nvidia.com>
Date: Fri, 7 Nov 2025 10:12:09 -0400
From: Jason Gunthorpe <jgg@...dia.com>
To: Tzung-Bi Shih <tzungbi@...nel.org>
Cc: Benson Leung <bleung@...omium.org>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	"Rafael J . Wysocki" <rafael@...nel.org>,
	Danilo Krummrich <dakr@...nel.org>,
	Jonathan Corbet <corbet@....net>, Shuah Khan <shuah@...nel.org>,
	linux-doc@...r.kernel.org, linux-kernel@...r.kernel.org,
	chrome-platform@...ts.linux.dev, linux-kselftest@...r.kernel.org,
	Laurent Pinchart <laurent.pinchart@...asonboard.com>,
	Bartosz Golaszewski <brgl@...ev.pl>,
	Wolfram Sang <wsa+renesas@...g-engineering.com>,
	Simona Vetter <simona.vetter@...ll.ch>,
	Dan Williams <dan.j.williams@...el.com>
Subject: Re: [PATCH v5 5/7] revocable: Add fops replacement

On Fri, Nov 07, 2025 at 04:11:40AM +0000, Tzung-Bi Shih wrote:
> Realized the approach doesn't work for the issue I'm looking into.
> 
> - All misc devices share the same cdev[1].  If misc_deregister() calls
>   cdev_sync_revoke(), the misc stop working due to one of the miscdevice
>   deregistered.

> [1] https://elixir.bootlin.com/linux/v6.17/source/drivers/char/misc.c#L299

That's not a "cdev" in this context, but yes, misc doesn't use
struct cdev at all.. Instead you have a struct miscdevice which has a
similar lifecycle as cdev. Indeed you can't use what I showed above at
the cdev layer exactly as is, but there is not a fundamental issue
here.

> - The context (struct cdev_sync_data) should be the same lifecycle with
>   the opening file (e.g. struct file).  Otherwise, when accessing the
>   context in the fops wrappers, it results an UAF.  For example, the
>   sturct cdev is likely freed after cdev_sync_revoke().

Yes, it should be tied to the memory lifecycle of the struct device
under the cdev which would then by tied to the file lifecycle. It is
not hard.

Jason