netdev - [question] potential race between capinc_tty_init & capi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <af56f61a-6343-85fd-3efc-b3a2890246ac@gmail.com>
Date:   Tue, 17 Aug 2021 14:43:22 +0530
From:   Saubhik Mukherjee <saubhik.mukherjee@...il.com>
To:     isdn@...ux-pingi.de, gregkh@...uxfoundation.org,
        jirislaby@...nel.org, dsterba@...e.com, jcmvbkbc@...il.com,
        johannes@...solutions.net, kuba@...nel.org
Cc:     netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        andrianov@...ras.ru
Subject: [question] potential race between capinc_tty_init & capi_release

In drivers/isdn/capi/capi.c, based on the output of a static analysis 
tool, we found the possibility of the following race condition:

In capi_init, register_chrdev registers file operations callbacks, 
capi_fops. Then capinc_tty_init is executed.

Simultaneously the following chain of calls can occur (after a 
successful capi_open call).

capi_release -> capincci_free -> capincci_free_minor -> capiminor_free 
-> tty_unregister_device

tty_unregister_device reads capinc_tty_driver, which might not have been 
initialized at this point. So, we have a race between capi_release and 
capinc_tty_init.

If this is a possible race scenario, maybe moving register_chrdev after 
capinc_tty_init could fix it. But I am not sure if this will break 
something else. Please let me know if this is a potential race and can 
be fixed as mentioned.

Since this is based on a static analysis tool, this is not tested.