netdev - Re: [PATCH net 000/117] net: avoid to remove module when its debugfs is being used

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 09 Oct 2020 07:09:01 +0200
From:   Nicolai Stange <nstange@...e.de>
To:     Johannes Berg <johannes@...solutions.net>
Cc:     David Laight <David.Laight@...LAB.COM>,
        'Taehee Yoo' <ap420073@...il.com>,
        "davem\@davemloft.net" <davem@...emloft.net>,
        "kuba\@kernel.org" <kuba@...nel.org>,
        "netdev\@vger.kernel.org" <netdev@...r.kernel.org>,
        Nicolai Stange <nstange@...e.de>,
        "linux-wireless\@vger.kernel.org" <linux-wireless@...r.kernel.org>,
        "wil6210\@qti.qualcomm.com" <wil6210@....qualcomm.com>,
        "brcm80211-dev-list\@cypress.com" <brcm80211-dev-list@...ress.com>,
        "b43-dev\@lists.infradead.org" <b43-dev@...ts.infradead.org>,
        "linux-bluetooth\@vger.kernel.org" <linux-bluetooth@...r.kernel.org>
Subject: Re: [PATCH net 000/117] net: avoid to remove module when its debugfs is being used

Johannes Berg <johannes@...solutions.net> writes:

> On Thu, 2020-10-08 at 15:59 +0000, David Laight wrote:
>> From: Taehee Yoo
>> > Sent: 08 October 2020 16:49
>> > 
>> > When debugfs file is opened, its module should not be removed until
>> > it's closed.
>> > Because debugfs internally uses the module's data.
>> > So, it could access freed memory.
>> > 
>> > In order to avoid panic, it just sets .owner to THIS_MODULE.
>> > So that all modules will be held when its debugfs file is opened.
>> 
>> Can't you fix it in common code?

Probably not: it's the call to ->release() that's faulting in the Oops
quoted in the cover letter and that one can't be protected by the
core debugfs code, unfortunately.

There's a comment in full_proxy_release(), which reads as

	/*
	 * We must not protect this against removal races here: the
	 * original releaser should be called unconditionally in order
	 * not to leak any resources. Releasers must not assume that
	 * ->i_private is still being meaningful here.
	 */

> Yeah I was just wondering that too - weren't the proxy_fops even already
> intended to fix this?

No, as far as file_operations are concerned, the proxy fops's intent was
only to ensure that the memory the file_operations' ->owner resides in
is still valid so that try_module_get() won't splat at file open
(c.f. [1]).

You're right that the default "full" proxy fops do prevent all
file_operations but ->release() from getting invoked on removed files,
but the motivation had not been to protect the file_operations
themselves, but accesses to any stale data associated with removed files
([2]).


> The modules _should_ be removing the debugfs files, and then the
> proxy_fops should kick in, no?

No, as said, not for ->release(). I haven't looked into the inidividual
patches here, but setting ->owner indeed sounds like the right thing to
do.

But you're right that modules should be removing any left debugfs files
at exit.

Thanks,

Nicolai


[1] 9fd4dcece43a ("debugfs: prevent access to possibly dead
                   file_operations at file open")
[2] 49d200deaa68 ("debugfs: prevent access to removed files' private data")

-- 
SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
(HRB 36809, AG Nürnberg), GF: Felix Imendörffer