netdev - Re: [question] potential race between capinc_tty_init & capi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 17 Aug 2021 18:28:05 +0200
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Saubhik Mukherjee <saubhik.mukherjee@...il.com>
Cc:     isdn@...ux-pingi.de, jirislaby@...nel.org, dsterba@...e.com,
        jcmvbkbc@...il.com, johannes@...solutions.net, kuba@...nel.org,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        andrianov@...ras.ru
Subject: Re: [question] potential race between capinc_tty_init & capi_release

On Tue, Aug 17, 2021 at 02:43:22PM +0530, Saubhik Mukherjee wrote:
> In drivers/isdn/capi/capi.c, based on the output of a static analysis tool,
> we found the possibility of the following race condition:

Do you know of any isdn capi devices out there in the world right now?

> 
> In capi_init, register_chrdev registers file operations callbacks,
> capi_fops. Then capinc_tty_init is executed.
> 
> Simultaneously the following chain of calls can occur (after a successful
> capi_open call).
> 
> capi_release -> capincci_free -> capincci_free_minor -> capiminor_free ->
> tty_unregister_device
> 
> tty_unregister_device reads capinc_tty_driver, which might not have been
> initialized at this point. So, we have a race between capi_release and
> capinc_tty_init.
> 
> If this is a possible race scenario, maybe moving register_chrdev after
> capinc_tty_init could fix it. But I am not sure if this will break something
> else. Please let me know if this is a potential race and can be fixed as
> mentioned.

Would you be racing now if someone opened/closed the tty device node
before the char device node was created?

Anyway, this is really old and obsolete code, odds are it can just be
removed entirely.

thanks,

greg k-h