netdev - Possible race in ks8851

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <49e80d06-531e-178e-1cb0-3293f275847f@ispras.ru>
Date:   Tue, 15 Aug 2017 18:57:32 +0300
From:   Anton Volkov <avolkov@...ras.ru>
To:     david.choi@...rel.com, davem@...emloft.net
Cc:     netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        ldv-project@...uxtesting.org,
        Alexey Khoroshilov <khoroshilov@...ras.ru>
Subject: Possible race in ks8851_mll.ko

Hello.

While searching for races in the Linux kernel I've come across
"drivers/net/ethernet/micrel/ks8851_mll.ko" module. Here is a question 
that I came up with while analyzing results. Lines are given using the 
info from Linux v4.12.

Consider the following case:

Thread 1:                    Thread 2:
ks8851_probe
   ks = netdev_priv(netdev)
   register_netdev
                              ks_start_xmit
->ks_soft_reset              ->ks_tx_fifo_space
   ->ks_wrreg16                 ->ks_rdreg16
       ks->cmd_reg_cache = ...      ks->cmd_reg_cache = ...
       (ks8851_mll.c: line 536)     (ks8851_mll.c: line 505)
       iowrite16(ks->cmd_reg_cache) iowrite16(ks->cmd_reg_cache)

In this case early registration of netdev leads to callback interference 
in the initialization process. Both ks_wrreg16() and ks_rdreg16() use 
the same ks. If one of them changes the ks->cmd_reg_cache it is possible 
that both will use the same value though it should be different. Is this 
race feasible from your point of view?

Thank you for your time.

-- Anton Volkov
Linux Verification Center, ISPRAS
web: http://linuxtesting.org
e-mail: avolkov@...ras.ru