pps: fix a UAF and clean up code

[PATCH 0/6] pps: fix a UAF and clean up code

Posted by Michal Schmidt 1 year, 2 months ago

The 1st patch fixes a UAF bug. The fix is quite minimal, although a bit
ugly. The rest of the series are cleanups in the area.

Michal Schmidt (6):
  pps: fix cdev use-after-free
  pps: simplify pps_idr_lock locking
  pps: use scoped_guard for pps_idr_lock
  pps: print error in both cdev and dev error paths in
    pps_register_cdev()
  pps: embed "dev" in the pps_device
  pps: use cdev_device_add()

 drivers/pps/clients/pps-gpio.c    |  2 +-
 drivers/pps/clients/pps-ldisc.c   |  6 +-
 drivers/pps/clients/pps_parport.c |  4 +-
 drivers/pps/kapi.c                | 10 ++--
 drivers/pps/pps.c                 | 94 +++++++++++++------------------
 include/linux/pps_kernel.h        |  2 +-
 6 files changed, 50 insertions(+), 68 deletions(-)


base-commit: 7af08b57bcb9ebf78675c50069c54125c0a8b795
-- 
2.47.0

Re: [PATCH 0/6] pps: fix a UAF and clean up code

Posted by Calvin Owens 1 year, 2 months ago

On Monday 12/02 at 17:34 +0100, Michal Schmidt wrote:
> The 1st patch fixes a UAF bug. The fix is quite minimal, although a bit
> ugly. The rest of the series are cleanups in the area.

Hi Michal,

I've also been poking at this, I've sent some patches recently:

    https://lore.kernel.org/all/a17975fd5ae99385791929e563f72564edbcf28f.1731383727.git.calvin@wbinvd.org/

The major difference is that I used __register_chrdev() and removed the
embedded cdev too. I think that is cleaner, what do you think?

Thanks,
Calvin

> Michal Schmidt (6):
>   pps: fix cdev use-after-free
>   pps: simplify pps_idr_lock locking
>   pps: use scoped_guard for pps_idr_lock
>   pps: print error in both cdev and dev error paths in
>     pps_register_cdev()
>   pps: embed "dev" in the pps_device
>   pps: use cdev_device_add()
> 
>  drivers/pps/clients/pps-gpio.c    |  2 +-
>  drivers/pps/clients/pps-ldisc.c   |  6 +-
>  drivers/pps/clients/pps_parport.c |  4 +-
>  drivers/pps/kapi.c                | 10 ++--
>  drivers/pps/pps.c                 | 94 +++++++++++++------------------
>  include/linux/pps_kernel.h        |  2 +-
>  6 files changed, 50 insertions(+), 68 deletions(-)
> 
> 
> base-commit: 7af08b57bcb9ebf78675c50069c54125c0a8b795
> -- 
> 2.47.0
>

Re: [PATCH 0/6] pps: fix a UAF and clean up code

Posted by Michal Schmidt 1 year, 2 months ago

On Mon, Dec 2, 2024 at 5:56 PM Calvin Owens <calvin@wbinvd.org> wrote:
>
> On Monday 12/02 at 17:34 +0100, Michal Schmidt wrote:
> > The 1st patch fixes a UAF bug. The fix is quite minimal, although a bit
> > ugly. The rest of the series are cleanups in the area.
>
> Hi Michal,
>
> I've also been poking at this, I've sent some patches recently:
>
>     https://lore.kernel.org/all/a17975fd5ae99385791929e563f72564edbcf28f.1731383727.git.calvin@wbinvd.org/
>
> The major difference is that I used __register_chrdev() and removed the
> embedded cdev too. I think that is cleaner, what do you think?
>
> Thanks,
> Calvin

I agree. Let's go with yours.
Michal

> > Michal Schmidt (6):
> >   pps: fix cdev use-after-free
> >   pps: simplify pps_idr_lock locking
> >   pps: use scoped_guard for pps_idr_lock
> >   pps: print error in both cdev and dev error paths in
> >     pps_register_cdev()
> >   pps: embed "dev" in the pps_device
> >   pps: use cdev_device_add()
> >
> >  drivers/pps/clients/pps-gpio.c    |  2 +-
> >  drivers/pps/clients/pps-ldisc.c   |  6 +-
> >  drivers/pps/clients/pps_parport.c |  4 +-
> >  drivers/pps/kapi.c                | 10 ++--
> >  drivers/pps/pps.c                 | 94 +++++++++++++------------------
> >  include/linux/pps_kernel.h        |  2 +-
> >  6 files changed, 50 insertions(+), 68 deletions(-)
> >
> >
> > base-commit: 7af08b57bcb9ebf78675c50069c54125c0a8b795
> > --
> > 2.47.0
> >
>