[Bug 220981] Potential data race in drivers/usb/class/cdc-wdm.c::wdm_read

[bugzilla-daemon@kernel.org]

https://bugzilla.kernel.org/show_bug.cgi?id=220981

Oliver Neukum (oliver@neukum.org) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |oliver@neukum.org

--- Comment #1 from Oliver Neukum (oliver@neukum.org) ---
(In reply to Francesco Vincenti from comment #0)

> By looking at wdm_read() implementation:
> wdm_read() copies data from desc->ubuf to userspace through copy_to_user(),
> without holding the spin-lock desc->iuspin,
> while the RX completion handler wdm_in_callback() may simultaneously write
> desc->ubuf under the same spin-lock.

wdm_in_callback() adds only to the tail of the buffer, while wdm_read() only
takes from the head of the buffer while having dropped the lock. So, yes, there
can be simultaneous uses of the buffer, but they cannot corrupt data.

AFAICT this bug does not exist.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.