From: Kees Cook <keescook@chromium.org> To: Brian Norris <computersforpeace@gmail.com> Cc: Shuah Khan <shuahkh@osg.samsung.com>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Ming Lei <ming.lei@canonical.com>, LKML <linux-kernel@vger.kernel.org>, Linux API <linux-api@vger.kernel.org>, "Luis R. Rodriguez" <mcgrof@suse.com> Subject: Re: [PATCH v2 3/5] test: firmware_class: add asynchronous request trigger Date: Wed, 9 Dec 2015 15:22:32 -0800 [thread overview] Message-ID: <CAGXu5jLPDE+Pt0QxZ3M_crcN_7thdAosQPU5cFOMQF-SFy17wA@mail.gmail.com> (raw) In-Reply-To: <1449701429-121423-3-git-send-email-computersforpeace@gmail.com> On Wed, Dec 9, 2015 at 2:50 PM, Brian Norris <computersforpeace@gmail.com> wrote: > We might want to test for bugs like that found in commit f9692b2699bd > ("firmware: fix possible use after free on name on asynchronous > request"), where the asynchronous request API had race conditions. > > Let's add a simple file that will launch the async request, then wait > until it's complete and report the status. It's not a true async test > (we're using a mutex + wait_for_completion(), so we can't get more than > one going at the same time), but it does help make sure the basic API is > sane, and it can catch some class of bugs. > > Signed-off-by: Brian Norris <computersforpeace@gmail.com> > Cc: Luis R. Rodriguez <mcgrof@suse.com> Acked-by: Kees Cook <keescook@chromium.org> -Kees > --- > v2: > * use kstrndup() > * don't kfree(name) too early! > > lib/test_firmware.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 65 insertions(+) > > diff --git a/lib/test_firmware.c b/lib/test_firmware.c > index 690b9c35a274..a3e8ec3fb1c5 100644 > --- a/lib/test_firmware.c > +++ b/lib/test_firmware.c > @@ -12,6 +12,7 @@ > #include <linux/init.h> > #include <linux/module.h> > #include <linux/printk.h> > +#include <linux/completion.h> > #include <linux/firmware.h> > #include <linux/device.h> > #include <linux/fs.h> > @@ -80,6 +81,57 @@ out: > } > static DEVICE_ATTR_WO(trigger_request); > > +static DECLARE_COMPLETION(async_fw_done); > + > +static void trigger_async_request_cb(const struct firmware *fw, void *context) > +{ > + test_firmware = fw; > + complete(&async_fw_done); > +} > + > +static ssize_t trigger_async_request_store(struct device *dev, > + struct device_attribute *attr, > + const char *buf, size_t count) > +{ > + int rc; > + char *name; > + > + name = kstrndup(buf, count, GFP_KERNEL); > + if (!name) > + return -ENOSPC; > + > + pr_info("loading '%s'\n", name); > + > + mutex_lock(&test_fw_mutex); > + release_firmware(test_firmware); > + test_firmware = NULL; > + rc = request_firmware_nowait(THIS_MODULE, 1, name, dev, GFP_KERNEL, > + NULL, trigger_async_request_cb); > + if (rc) { > + pr_info("async load of '%s' failed: %d\n", name, rc); > + kfree(name); > + goto out; > + } > + /* Free 'name' ASAP, to test for race conditions */ > + kfree(name); > + > + wait_for_completion(&async_fw_done); > + > + if (test_firmware) { > + pr_info("loaded: %zu\n", test_firmware->size); > + rc = count; > + } else { > + pr_err("failed to async load firmware\n"); > + rc = -ENODEV; > + } > + > +out: > + mutex_unlock(&test_fw_mutex); > + > + return rc; > +} > +static DEVICE_ATTR_WO(trigger_async_request); > + > static int __init test_firmware_init(void) > { > int rc; > @@ -96,9 +148,20 @@ static int __init test_firmware_init(void) > goto dereg; > } > > + rc = device_create_file(test_fw_misc_device.this_device, > + &dev_attr_trigger_async_request); > + if (rc) { > + pr_err("could not create async sysfs interface: %d\n", rc); > + goto remove_file; > + } > + > pr_warn("interface ready\n"); > > return 0; > + > +remove_file: > + device_remove_file(test_fw_misc_device.this_device, > + &dev_attr_trigger_async_request); > dereg: > misc_deregister(&test_fw_misc_device); > return rc; > @@ -110,6 +173,8 @@ static void __exit test_firmware_exit(void) > { > release_firmware(test_firmware); > device_remove_file(test_fw_misc_device.this_device, > + &dev_attr_trigger_async_request); > + device_remove_file(test_fw_misc_device.this_device, > &dev_attr_trigger_request); > misc_deregister(&test_fw_misc_device); > pr_warn("removed interface\n"); > -- > 2.6.0.rc2.230.g3dd15c0 > -- Kees Cook Chrome OS & Brillo Security
WARNING: multiple messages have this Message-ID (diff)
From: Kees Cook <keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org> To: Brian Norris <computersforpeace-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> Cc: Shuah Khan <shuahkh-JPH+aEBZ4P+UEJcrhfAQsw@public.gmane.org>, Greg Kroah-Hartman <gregkh-hQyY1W1yCW8ekmWlsbkhG0B+6BGkLq7r@public.gmane.org>, Ming Lei <ming.lei-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>, LKML <linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>, Linux API <linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>, "Luis R. Rodriguez" <mcgrof-IBi9RG/b67k@public.gmane.org> Subject: Re: [PATCH v2 3/5] test: firmware_class: add asynchronous request trigger Date: Wed, 9 Dec 2015 15:22:32 -0800 [thread overview] Message-ID: <CAGXu5jLPDE+Pt0QxZ3M_crcN_7thdAosQPU5cFOMQF-SFy17wA@mail.gmail.com> (raw) In-Reply-To: <1449701429-121423-3-git-send-email-computersforpeace-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> On Wed, Dec 9, 2015 at 2:50 PM, Brian Norris <computersforpeace-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote: > We might want to test for bugs like that found in commit f9692b2699bd > ("firmware: fix possible use after free on name on asynchronous > request"), where the asynchronous request API had race conditions. > > Let's add a simple file that will launch the async request, then wait > until it's complete and report the status. It's not a true async test > (we're using a mutex + wait_for_completion(), so we can't get more than > one going at the same time), but it does help make sure the basic API is > sane, and it can catch some class of bugs. > > Signed-off-by: Brian Norris <computersforpeace-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> > Cc: Luis R. Rodriguez <mcgrof-IBi9RG/b67k@public.gmane.org> Acked-by: Kees Cook <keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org> -Kees > --- > v2: > * use kstrndup() > * don't kfree(name) too early! > > lib/test_firmware.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 65 insertions(+) > > diff --git a/lib/test_firmware.c b/lib/test_firmware.c > index 690b9c35a274..a3e8ec3fb1c5 100644 > --- a/lib/test_firmware.c > +++ b/lib/test_firmware.c > @@ -12,6 +12,7 @@ > #include <linux/init.h> > #include <linux/module.h> > #include <linux/printk.h> > +#include <linux/completion.h> > #include <linux/firmware.h> > #include <linux/device.h> > #include <linux/fs.h> > @@ -80,6 +81,57 @@ out: > } > static DEVICE_ATTR_WO(trigger_request); > > +static DECLARE_COMPLETION(async_fw_done); > + > +static void trigger_async_request_cb(const struct firmware *fw, void *context) > +{ > + test_firmware = fw; > + complete(&async_fw_done); > +} > + > +static ssize_t trigger_async_request_store(struct device *dev, > + struct device_attribute *attr, > + const char *buf, size_t count) > +{ > + int rc; > + char *name; > + > + name = kstrndup(buf, count, GFP_KERNEL); > + if (!name) > + return -ENOSPC; > + > + pr_info("loading '%s'\n", name); > + > + mutex_lock(&test_fw_mutex); > + release_firmware(test_firmware); > + test_firmware = NULL; > + rc = request_firmware_nowait(THIS_MODULE, 1, name, dev, GFP_KERNEL, > + NULL, trigger_async_request_cb); > + if (rc) { > + pr_info("async load of '%s' failed: %d\n", name, rc); > + kfree(name); > + goto out; > + } > + /* Free 'name' ASAP, to test for race conditions */ > + kfree(name); > + > + wait_for_completion(&async_fw_done); > + > + if (test_firmware) { > + pr_info("loaded: %zu\n", test_firmware->size); > + rc = count; > + } else { > + pr_err("failed to async load firmware\n"); > + rc = -ENODEV; > + } > + > +out: > + mutex_unlock(&test_fw_mutex); > + > + return rc; > +} > +static DEVICE_ATTR_WO(trigger_async_request); > + > static int __init test_firmware_init(void) > { > int rc; > @@ -96,9 +148,20 @@ static int __init test_firmware_init(void) > goto dereg; > } > > + rc = device_create_file(test_fw_misc_device.this_device, > + &dev_attr_trigger_async_request); > + if (rc) { > + pr_err("could not create async sysfs interface: %d\n", rc); > + goto remove_file; > + } > + > pr_warn("interface ready\n"); > > return 0; > + > +remove_file: > + device_remove_file(test_fw_misc_device.this_device, > + &dev_attr_trigger_async_request); > dereg: > misc_deregister(&test_fw_misc_device); > return rc; > @@ -110,6 +173,8 @@ static void __exit test_firmware_exit(void) > { > release_firmware(test_firmware); > device_remove_file(test_fw_misc_device.this_device, > + &dev_attr_trigger_async_request); > + device_remove_file(test_fw_misc_device.this_device, > &dev_attr_trigger_request); > misc_deregister(&test_fw_misc_device); > pr_warn("removed interface\n"); > -- > 2.6.0.rc2.230.g3dd15c0 > -- Kees Cook Chrome OS & Brillo Security
next prev parent reply other threads:[~2015-12-09 23:22 UTC|newest] Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top 2015-12-09 22:50 [PATCH v2 1/5] test: firmware_class: report errors properly on failure Brian Norris 2015-12-09 22:50 ` Brian Norris 2015-12-09 22:50 ` [PATCH v2 2/5] test: firmware_class: use kstrndup() where appropriate Brian Norris 2015-12-09 22:50 ` Brian Norris 2016-01-07 20:55 ` Shuah Khan 2016-01-07 20:55 ` Shuah Khan 2015-12-09 22:50 ` [PATCH v2 3/5] test: firmware_class: add asynchronous request trigger Brian Norris 2015-12-09 22:50 ` Brian Norris 2015-12-09 23:22 ` Kees Cook [this message] 2015-12-09 23:22 ` Kees Cook 2016-01-07 20:56 ` Shuah Khan 2015-12-09 22:50 ` [PATCH v2 4/5] firmware: actually return NULL on failed request_firmware_nowait() Brian Norris 2015-12-09 22:50 ` Brian Norris 2015-12-21 19:06 ` Luis R. Rodriguez 2016-01-07 20:56 ` Shuah Khan 2016-01-07 20:56 ` Shuah Khan 2015-12-09 22:50 ` [PATCH v2 5/5] selftests: firmware: add empty string and async tests Brian Norris 2015-12-09 22:50 ` Brian Norris 2016-01-07 20:57 ` Shuah Khan 2016-01-07 20:57 ` Shuah Khan 2016-01-07 21:39 ` Brian Norris 2016-01-07 21:39 ` Brian Norris 2016-01-07 21:42 ` Shuah Khan 2016-01-07 21:42 ` Shuah Khan 2016-01-07 20:54 ` [PATCH v2 1/5] test: firmware_class: report errors properly on failure Shuah Khan 2016-01-07 20:54 ` Shuah Khan
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=CAGXu5jLPDE+Pt0QxZ3M_crcN_7thdAosQPU5cFOMQF-SFy17wA@mail.gmail.com \ --to=keescook@chromium.org \ --cc=computersforpeace@gmail.com \ --cc=gregkh@linuxfoundation.org \ --cc=linux-api@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=mcgrof@suse.com \ --cc=ming.lei@canonical.com \ --cc=shuahkh@osg.samsung.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.