[lkml]   [2017]   [Aug]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectPossible double free in iowarrior.ko

While searching for races in the Linux kernel I've come across
"drivers/usb/misc/iowarrior.ko" module. Here are questions that I came
up with while analyzing results. Lines are given using the info from
Linux v4.12.

Consider the following case:

Thread 1: Thread 2:
iowarrior_release iowarrior_disconnect
dev->present = 0
(iowarrior.c: line 889)
mutex_lock(&dev->mutex) mutex_unlock(&dev->mutex)
dev->opened = 0
(iowarrior.c: line 666) if(dev->opened){
if(dev->present){ //dev->opened == 0
//dev->present ==0
} else { } else {
mutex_unlock(&dev->mutex) iowarrior_delete(dev)
iowarrior_delete(dev) }

In this case double free of several pointers inside iowarrior_delete
becomes possible and no calls to usb_kill_urb() and
wake_up_interruptible() are present. Is this feasible from your point of
view? If so, maybe it is a good idea to move mutex_unlock(&dev->mutex)
in iowarrior_disconnect() further down like in iowarrior_release() in
both 'if' branches?

Thank you for your time

-- Anton Volkov
Linux Verification Center, ISPRAS

 \ /
  Last update: 2017-08-22 16:52    [W:0.017 / U:1.856 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site