netdev - Re: [PATCH net-next] net: wwan: core: Return poll error in case of port removal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 22 Apr 2021 13:21:47 +0200
From:   Loic Poulain <loic.poulain@...aro.org>
To:     Leon Romanovsky <leon@...nel.org>
Cc:     Jakub Kicinski <kuba@...nel.org>,
        David Miller <davem@...emloft.net>,
        Network Development <netdev@...r.kernel.org>
Subject: Re: [PATCH net-next] net: wwan: core: Return poll error in case of
 port removal

Hi Leon,

On Thu, 22 Apr 2021 at 12:49, Leon Romanovsky <leon@...nel.org> wrote:
>
> On Thu, Apr 22, 2021 at 11:43:34AM +0200, Loic Poulain wrote:
> > Ensure that the poll system call returns error flags when port is
> > removed, allowing user side to properly fail, without trying read
> > or write. Port removal leads to nullified port operations, add a
> > is_port_connected() helper to safely check the status.
> >
> > Fixes: 9a44c1cc6388 ("net: Add a WWAN subsystem")
> > Signed-off-by: Loic Poulain <loic.poulain@...aro.org>
> > ---
> >  drivers/net/wwan/wwan_core.c | 17 +++++++++++++++--
> >  1 file changed, 15 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/net/wwan/wwan_core.c b/drivers/net/wwan/wwan_core.c
> > index 5be5e1e..c965b21 100644
> > --- a/drivers/net/wwan/wwan_core.c
> > +++ b/drivers/net/wwan/wwan_core.c
> > @@ -369,14 +369,25 @@ static int wwan_port_op_tx(struct wwan_port *port, struct sk_buff *skb)
> >       return ret;
> >  }
> >
> > +static bool is_port_connected(struct wwan_port *port)
> > +{
> > +     bool connected;
> > +
> > +     mutex_lock(&port->ops_lock);
> > +     connected = !!port->ops;
> > +     mutex_unlock(&port->ops_lock);
> > +
> > +     return connected;
> > +}
>
> The above can't be correct. What prevents to change the status of
> port->ops right before or after your mutex_lock/mutex_unlock?

Nothing, this is just to protect access to the variable (probably
overkill though), which can be concurrently nullified in port removal,
and to check if the event (poll wake-up) has been caused by removal of
the port, no port operation (port->ops...) is actually called on that
condition. If the status is changed right after the check, then any
subsequent poll/read/write syscall will simply fail properly.

Regards,
Loic