netdev - Re: [PATCH v2] isdn/gigaset: Convert timers to use timer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGXu5jJaMODs0NNasPY97wiXeQJ-Y5G+qLrFbwquhGJj=o3rxA@mail.gmail.com>
Date:   Fri, 6 Oct 2017 12:39:56 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Paul Bolle <pebolle@...cali.nl>
Cc:     Karsten Keil <isdn@...ux-pingi.de>,
        "David S. Miller" <davem@...emloft.net>,
        Johan Hovold <johan@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        gigaset307x-common@...ts.sourceforge.net,
        Network Development <netdev@...r.kernel.org>
Subject: Re: [PATCH v2] isdn/gigaset: Convert timers to use timer_setup()

On Fri, Oct 6, 2017 at 12:00 PM, Paul Bolle <pebolle@...cali.nl> wrote:
> On Thu, 2017-10-05 at 12:31 -0700, Kees Cook wrote:
>> --- a/drivers/isdn/gigaset/bas-gigaset.c
>> +++ b/drivers/isdn/gigaset/bas-gigaset.c
>
>> -static void cmd_in_timeout(unsigned long data)
>> +static void cmd_in_timeout(struct timer_list *t)
>>  {
>> -     struct cardstate *cs = (struct cardstate *) data;
>> -     struct bas_cardstate *ucs = cs->hw.bas;
>> +     struct bas_cardstate *ucs = from_timer(ucs, t, timer_cmd_in);
>> +     struct urb *urb = ucs->urb_int_in;
>> +     struct cardstate *cs = urb->context;
>
> This makes me nervous. Are you sure urb->context points to a struct cardstate
> here and in the other two places this patch changes?
>
> Anyhow, I'd like to have some time to do my review. So what's your timeframe
> here? I do hope I have at least a few weeks. (In other words: I hope gigaset
> isn't the only driver where the ability to use random pointers in these timer
> callbacks is removed.)

Hi!

I'm in no rush for any specific change. There are about 900 call sites
I'm making my way through, about 2/3rd are pretty trivial, and the
less obvious is what I've started sending out now, since I expect some
will need some more careful review.

Thanks for taking a look at it!

-Kees

-- 
Kees Cook
Pixel Security