netdev - Re: [PATCH net-next] net: wwan: core: Return poll error in case of port removal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YIFzLUNliMn1DO6h@unreal>
Date:   Thu, 22 Apr 2021 15:59:25 +0300
From:   Leon Romanovsky <leon@...nel.org>
To:     Loic Poulain <loic.poulain@...aro.org>
Cc:     Jakub Kicinski <kuba@...nel.org>,
        David Miller <davem@...emloft.net>,
        Network Development <netdev@...r.kernel.org>
Subject: Re: [PATCH net-next] net: wwan: core: Return poll error in case of
 port removal

On Thu, Apr 22, 2021 at 01:21:47PM +0200, Loic Poulain wrote:
> Hi Leon,
> 
> On Thu, 22 Apr 2021 at 12:49, Leon Romanovsky <leon@...nel.org> wrote:
> >
> > On Thu, Apr 22, 2021 at 11:43:34AM +0200, Loic Poulain wrote:
> > > Ensure that the poll system call returns error flags when port is
> > > removed, allowing user side to properly fail, without trying read
> > > or write. Port removal leads to nullified port operations, add a
> > > is_port_connected() helper to safely check the status.
> > >
> > > Fixes: 9a44c1cc6388 ("net: Add a WWAN subsystem")
> > > Signed-off-by: Loic Poulain <loic.poulain@...aro.org>
> > > ---
> > >  drivers/net/wwan/wwan_core.c | 17 +++++++++++++++--
> > >  1 file changed, 15 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/drivers/net/wwan/wwan_core.c b/drivers/net/wwan/wwan_core.c
> > > index 5be5e1e..c965b21 100644
> > > --- a/drivers/net/wwan/wwan_core.c
> > > +++ b/drivers/net/wwan/wwan_core.c
> > > @@ -369,14 +369,25 @@ static int wwan_port_op_tx(struct wwan_port *port, struct sk_buff *skb)
> > >       return ret;
> > >  }
> > >
> > > +static bool is_port_connected(struct wwan_port *port)
> > > +{
> > > +     bool connected;
> > > +
> > > +     mutex_lock(&port->ops_lock);
> > > +     connected = !!port->ops;
> > > +     mutex_unlock(&port->ops_lock);
> > > +
> > > +     return connected;
> > > +}
> >
> > The above can't be correct. What prevents to change the status of
> > port->ops right before or after your mutex_lock/mutex_unlock?
> 
> Nothing, this is just to protect access to the variable (probably
> overkill though), which can be concurrently nullified in port removal,
> and to check if the event (poll wake-up) has been caused by removal of
> the port, no port operation (port->ops...) is actually called on that
> condition. If the status is changed right after the check, then any
> subsequent poll/read/write syscall will simply fail properly.

Taking locks when it is not needed is not overkill, but bug.

I wander if all these is_*_blocked() checks can be trusted if port->ops
pointer flips.

Thanks

> 
> Regards,
> Loic