From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934174AbdDZPs2 (ORCPT ); Wed, 26 Apr 2017 11:48:28 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:40028 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752267AbdDZPsV (ORCPT ); Wed, 26 Apr 2017 11:48:21 -0400 Date: Wed, 26 Apr 2017 17:48:12 +0200 From: Greg KH To: Adrian Salido Cc: linux-kernel@vger.kernel.org Subject: Re: [PATCH] driver core: platform: fix race condition with driver_override Message-ID: <20170426154812.GA18399@kroah.com> References: <20170425235526.GA165155@google.com> <20170426115759.GB8813@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.8.2 (2017-04-18) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Apr 26, 2017 at 07:51:32AM -0700, Adrian Salido wrote: > > > The driver_override implementation is susceptible to race condition when > > > different threads are reading vs storing a different driver override. > > > Add locking to avoid race condition. > > > > > > Fixes: 3d713e0e382e ("driver core: platform: add device binding path 'driver_override'") > > > Cc: stable@vger.kernel.org > > > Signed-off-by: Adrian Salido > > > --- > > > drivers/base/platform.c | 11 +++++++++-- > > > 1 file changed, 9 insertions(+), 2 deletions(-) > > > > > > diff --git a/drivers/base/platform.c b/drivers/base/platform.c > > > index c2456839214a..493e03fa0e07 100644 > > > --- a/drivers/base/platform.c > > > +++ b/drivers/base/platform.c > > > @@ -866,7 +866,7 @@ static ssize_t driver_override_store(struct device *dev, > > > const char *buf, size_t count) > > > { > > > struct platform_device *pdev = to_platform_device(dev); > > > - char *driver_override, *old = pdev->driver_override, *cp; > > > + char *driver_override, *old, *cp; > > > > > > if (count > PATH_MAX) > > > return -EINVAL; > > > @@ -879,12 +879,15 @@ static ssize_t driver_override_store(struct device *dev, > > > if (cp) > > > *cp = '\0'; > > > > > > + device_lock(dev); > > > + old = pdev->driver_override; > > > if (strlen(driver_override)) { > > > pdev->driver_override = driver_override; > > > } else { > > > kfree(driver_override); > > > pdev->driver_override = NULL; > > > } > > > + device_unlock(dev); > > > > > > kfree(old); > > > > Shouldn't you move the lock until after the kfree()? Or am I missing > > what the lock is trying to protect here? > > not really, the lock only protecting the variable > pdev->driver_override. Once the value has changed we no longer care > about "old" variable What are you protecting it from? Being overwritten twice? Or something else? > > > if (cp) > > > *cp = '\0'; > > > > > > + device_lock(dev); > > > + old = pdev->driver_override; > > > if (strlen(driver_override)) { > > > pdev->driver_override = driver_override; > > > } else { > > > kfree(driver_override); > > > pdev->driver_override = NULL; > > > } > > > + device_unlock(dev); > > > > > > kfree(old); > > > > > > > > @@ -895,8 +898,12 @@ static ssize_t driver_override_show(struct device *dev, > > > struct device_attribute *attr, char *buf) > > > { > > > struct platform_device *pdev = to_platform_device(dev); > > > + ssize_t len; > > > > > > - return sprintf(buf, "%s\n", pdev->driver_override); > > > + device_lock(dev); > > > + len = sprintf(buf, "%s\n", pdev->driver_override); > > > + device_unlock(dev); > > > + return len; > > > > Why does the show function need to be changed at all? How can anything > > "race" here? > > The lock is trying to protect again race between store and show. > Suppose there are 2 threads: > > Thread1: > while (1) { > driver_override_store("foo"); > driver_override_store(""); > } > > Thread2: > while (1) driver_override_show(); > > Thread 1 | Thread 2 > ----------------------------------------|----------------------- > old = pdev->driver_override; | > | len = sprintf(buf, > "%s\n", pdev->driver_override); > | /* snprintf starts reading */ > pdev->driver_override = | > driver_override; | > kfree(old); | /* use after free before > snprintf finishes execution */ > > Similarly there could be a race between multiple threads doing store > where memory leaks could happen Ah, the printing of the string, that makes more sense, thanks, I was thinking of the assignment of the pointer itself, which is atomic on all sane platforms. As writing this is only allowed by root, it's not really a big deal, I'll queue it up for the next release. thanks, greg k-h