Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 15 Sep 2022 10:02:35 +0200
From:   Dominik Brodowski <linux@dominikbrodowski.net>
To:     Arnd Bergmann <arnd@arndb.de>
Cc:     Hyunwoo Kim <imv4bel@gmail.com>, laforge@gnumonks.org,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Ilpo =?iso-8859-1?Q?J=E4rvinen?= <ilpo.jarvinen@linux.intel.com>,
        linux-kernel@vger.kernel.org, Paul Fulghum <paulkf@microgate.com>,
        akpm@osdl.org, Lubomir Rintel <lkundrak@v3.sk>
Subject: Re: [PATCH] pcmcia: synclink_cs: Fix use-after-free in mgslpc_ioctl()
Message-ID: <YyLcG1hG5d6D4zNN@owl.dominikbrodowski.net>
References: <20220913052020.GA85241@ubuntu>
 <a8a9fd74-4ee5-4619-8492-be7139e6d48e@www.fastmail.com>
 <20220915020834.GA110086@ubuntu>
 <f41c2765-80e0-48bc-b1e4-8cfd3230fd4a@www.fastmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <f41c2765-80e0-48bc-b1e4-8cfd3230fd4a@www.fastmail.com>
Precedence: bulk

Am Thu, Sep 15, 2022 at 09:35:51AM +0200 schrieb Arnd Bergmann:
> On Thu, Sep 15, 2022, at 4:08 AM, Hyunwoo Kim wrote:
> > There are 3 other pcmica drivers in the path 
> > "drivers/char/pcmcia/synclink_cs.c", 
> > the path of the "synclink_cs.c" driver I reported the UAF to.
> > A similar UAF occurs in the "cm4000_cs.c" and "cm4040_cs.c" drivers. 
> > (this does not happen in scr24x_cs.c)
> ...
> > In the cm4000_cs.c driver, the race condition flow is tricky because of 
> > the start/stop_monitor() functions.
> >
> > The overall flow is similar to cm4040_cs.c.
> > Added one race condition to bypass the "dev->monitor_running" check.
> >
> >
> > So, should the above two drivers be removed from the kernel like the 
> > synclink_cs.c driver?
> >
> > Or should I submit a patch that fixes the UAF?
> 
> There is a good chance that we can remove both now, along with the
> synclink_cs. The scr24x driver is from 2016, but of course the
> hardware is much older. The cm4040/cm4000 drivers are from 2005.
> My guess is that the hardware still exists in actively used systems,
> but none of them get upgraded to modern kernels any more.
> 
> Let's just ask the driver authors (Lubomir and Harald) if they
> think the drivers may still be needed.

Actually, I'd prefer to apply a patch to fix this now-known problem first,
even if we deactive / remove these drivers immediately afterwards.

Thanks,
	Dominik