From: Dominik Brodowski <linux@dominikbrodowski.net>
To: Arnd Bergmann <arnd@arndb.de>
Cc: "Hyunwoo Kim" <imv4bel@gmail.com>,
laforge@gnumonks.org,
"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
"Ilpo Järvinen" <ilpo.jarvinen@linux.intel.com>,
linux-kernel@vger.kernel.org,
"Paul Fulghum" <paulkf@microgate.com>,
akpm@osdl.org, "Lubomir Rintel" <lkundrak@v3.sk>
Subject: Re: [PATCH] pcmcia: synclink_cs: Fix use-after-free in mgslpc_ioctl()
Date: Thu, 15 Sep 2022 10:02:35 +0200 [thread overview]
Message-ID: <YyLcG1hG5d6D4zNN@owl.dominikbrodowski.net> (raw)
In-Reply-To: <f41c2765-80e0-48bc-b1e4-8cfd3230fd4a@www.fastmail.com>
Am Thu, Sep 15, 2022 at 09:35:51AM +0200 schrieb Arnd Bergmann:
> On Thu, Sep 15, 2022, at 4:08 AM, Hyunwoo Kim wrote:
> > There are 3 other pcmica drivers in the path
> > "drivers/char/pcmcia/synclink_cs.c",
> > the path of the "synclink_cs.c" driver I reported the UAF to.
> > A similar UAF occurs in the "cm4000_cs.c" and "cm4040_cs.c" drivers.
> > (this does not happen in scr24x_cs.c)
> ...
> > In the cm4000_cs.c driver, the race condition flow is tricky because of
> > the start/stop_monitor() functions.
> >
> > The overall flow is similar to cm4040_cs.c.
> > Added one race condition to bypass the "dev->monitor_running" check.
> >
> >
> > So, should the above two drivers be removed from the kernel like the
> > synclink_cs.c driver?
> >
> > Or should I submit a patch that fixes the UAF?
>
> There is a good chance that we can remove both now, along with the
> synclink_cs. The scr24x driver is from 2016, but of course the
> hardware is much older. The cm4040/cm4000 drivers are from 2005.
> My guess is that the hardware still exists in actively used systems,
> but none of them get upgraded to modern kernels any more.
>
> Let's just ask the driver authors (Lubomir and Harald) if they
> think the drivers may still be needed.
Actually, I'd prefer to apply a patch to fix this now-known problem first,
even if we deactive / remove these drivers immediately afterwards.
Thanks,
Dominik
next prev parent reply other threads:[~2022-09-15 8:03 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-13 5:20 [PATCH] pcmcia: synclink_cs: Fix use-after-free in mgslpc_ioctl() Hyunwoo Kim
2022-09-13 14:59 ` Arnd Bergmann
2022-09-13 15:14 ` Paul Fulghum
2022-09-13 15:43 ` Hyunwoo Kim
2022-09-15 2:08 ` Hyunwoo Kim
2022-09-15 7:35 ` Arnd Bergmann
2022-09-15 8:02 ` Dominik Brodowski [this message]
2022-09-15 9:00 ` Hyunwoo Kim
2022-09-16 5:03 ` Hyunwoo Kim
2022-09-15 14:05 ` Harald Welte
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YyLcG1hG5d6D4zNN@owl.dominikbrodowski.net \
--to=linux@dominikbrodowski.net \
--cc=akpm@osdl.org \
--cc=arnd@arndb.de \
--cc=gregkh@linuxfoundation.org \
--cc=ilpo.jarvinen@linux.intel.com \
--cc=imv4bel@gmail.com \
--cc=laforge@gnumonks.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lkundrak@v3.sk \
--cc=paulkf@microgate.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).