netdev - Re: [PATCH net 2/2] net: phy: fix potential race in the phylib state machine

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0d5208d5-826a-8d33-1f61-fc9c52594fca@gmail.com>
Date:   Wed, 13 Feb 2019 20:13:45 -0800
From:   Florian Fainelli <f.fainelli@...il.com>
To:     Heiner Kallweit <hkallweit1@...il.com>,
        Andrew Lunn <andrew@...n.ch>,
        David Miller <davem@...emloft.net>
Cc:     Russell King - ARM Linux <linux@...linux.org.uk>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: [PATCH net 2/2] net: phy: fix potential race in the phylib state
 machine



On 2/13/2019 11:12 AM, Heiner Kallweit wrote:
> Russell reported the following race in the phylib state machine
> (quoting from his mail):
> 
> if (phy_polling_mode(phydev) && phy_is_started(phydev))
> 	phy_queue_state_machine(phydev, PHY_STATE_TIME);
> 
> state = PHY_UP
> thread 0			thread 1
> 				phy_disconnect()
> 				+-phy_is_started()
> phy_is_started()                |
> 				`-phy_stop()
> 				  +-phydev->state = PHY_HALTED
> 				  `-phy_stop_machine()
> 				    `-cancel_delayed_work_sync()
> phy_queue_state_machine()
> `-mod_delayed_work()
> 
> At this point, the phydev->state_queue() has been added back onto the
> system workqueue despite phy_stop_machine() having been called and
> cancel_delayed_work_sync() called on it.
> 
> Fix this by protecting the complete operation in thread 0.
> 
> Fixes: 2b3e88ea6528 ("net: phy: improve phy state checking")
> Reported-by: Russell King - ARM Linux admin <linux@...linux.org.uk>
> Signed-off-by: Heiner Kallweit <hkallweit1@...il.com>

Reviewed-by: Florian Fainelli <f.fainelli@...il.com>

-- 
Florian