From: Simon Horman <horms@kernel.org>
To: Henry Zhang <henryzhangjcle@gmail.com>
Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
tglx@linutronix.de, mingo@kernel.org,
syzbot+c6e7bcea7ffb7ff46acb@syzkaller.appspotmail.com,
Henry Zhang <zeri@umich.edu>, Eric Dumazet <edumazet@google.com>
Subject: Re: [PATCH net] mISDN: Fix data race in timer handling
Date: Wed, 28 Jan 2026 17:37:28 +0000 [thread overview]
Message-ID: <aXpJWC8daHd329w9@horms.kernel.org> (raw)
In-Reply-To: <20260127071927.1520272-1-zeri@umich.edu>
+ Eric
On Tue, Jan 27, 2026 at 02:19:27AM -0500, Henry Zhang wrote:
> KCSAN reported a data race where misdn_add_timer() writes dev->work
> while mISDN_read() reads it without holding the spinlock:
>
> write to 0xffff88812d848280 of 4 bytes by task 10864 on cpu 1:
> misdn_add_timer drivers/isdn/mISDN/timerdev.c:175 [inline]
> ...
>
> read to 0xffff88812d848280 of 4 bytes by task 10857 on cpu 0:
> mISDN_read+0x1f2/0x470 drivers/isdn/mISDN/timerdev.c:112
> ...
>
> dev->work is read locklessly in wait_event_interruptible() and
> mISDN_poll(). In mISDN_read(), the result is rechecked under dev->lock.
> In mISDN_poll(), a stale value may cause a spurious EPOLLIN or a missed
> wake, but wake_up_interruptible() will correct this. In both cases, the
> race is benign, so we can annotate these with READ_ONCE/WRITE_ONCE.
>
> Reported-by: syzbot+c6e7bcea7ffb7ff46acb@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=c6e7bcea7ffb7ff46acb
>
> Signed-off-by: Henry Zhang <zeri@umich.edu>
Hi Henry,
This appears to already be addressed by
commit 8175dbf174d4 ("mISDN: annotate data-race around dev->work")
--
pw-bot: cr
next prev parent reply other threads:[~2026-01-28 17:37 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-27 7:19 [PATCH net] mISDN: Fix data race in timer handling Henry Zhang
2026-01-28 17:37 ` Simon Horman [this message]
2026-01-28 19:00 ` Henry Zhang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aXpJWC8daHd329w9@horms.kernel.org \
--to=horms@kernel.org \
--cc=edumazet@google.com \
--cc=henryzhangjcle@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=syzbot+c6e7bcea7ffb7ff46acb@syzkaller.appspotmail.com \
--cc=tglx@linutronix.de \
--cc=zeri@umich.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox