From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753372AbbGWJpT (ORCPT ); Thu, 23 Jul 2015 05:45:19 -0400 Received: from cantor2.suse.de ([195.135.220.15]:56128 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752816AbbGWJnQ (ORCPT ); Thu, 23 Jul 2015 05:43:16 -0400 Message-ID: <1437644594.4377.12.camel@suse.com> Subject: Re: Several races in "usbnet" module (kernel 4.1.x) From: Oliver Neukum To: Eugene Shatokhin Cc: netdev@vger.kernel.org, linux-usb@vger.kernel.org, LKML Date: Thu, 23 Jul 2015 11:43:14 +0200 In-Reply-To: <55AD3A41.2040100@rosalab.ru> References: <55AD3A41.2040100@rosalab.ru> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.12.11 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 2015-07-20 at 21:13 +0300, Eugene Shatokhin wrote: > [Race #5] > > Race on dev->rx_urb_size. I reproduced it a similar way as the races > #2 > and #3 (changing MTU while downloading files). > > dev->rx_urb_size is written to here: > #0 usbnet_change_mtu (usbnet.c:392) > dev->rx_urb_size = dev->hard_mtu; > > Here is the conflicting read from dev->rx_urb_size: > * rx_submit (usbnet.c:467) > size_t size = dev->rx_urb_size; Yes, but what is the actual bad race? I mean, if you change the MTU in operation, there will be a race. That is just unavoidable. Do we generate errors? Regards Oliver From mboxrd@z Thu Jan 1 00:00:00 1970 From: Oliver Neukum Subject: Re: Several races in "usbnet" module (kernel 4.1.x) Date: Thu, 23 Jul 2015 11:43:14 +0200 Message-ID: <1437644594.4377.12.camel@suse.com> References: <55AD3A41.2040100@rosalab.ru> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit Cc: netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-usb-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, LKML To: Eugene Shatokhin Return-path: In-Reply-To: <55AD3A41.2040100-irhHPgl+04UvJsYlp49lxw@public.gmane.org> Sender: linux-usb-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-Id: netdev.vger.kernel.org On Mon, 2015-07-20 at 21:13 +0300, Eugene Shatokhin wrote: > [Race #5] > > Race on dev->rx_urb_size. I reproduced it a similar way as the races > #2 > and #3 (changing MTU while downloading files). > > dev->rx_urb_size is written to here: > #0 usbnet_change_mtu (usbnet.c:392) > dev->rx_urb_size = dev->hard_mtu; > > Here is the conflicting read from dev->rx_urb_size: > * rx_submit (usbnet.c:467) > size_t size = dev->rx_urb_size; Yes, but what is the actual bad race? I mean, if you change the MTU in operation, there will be a race. That is just unavoidable. Do we generate errors? Regards Oliver -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html