From: Anton Volkov <avolkov@ispras.ru>
To: samuel@sortiz.org, sda@bdit.de
Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
ldv-project@linuxtesting.org,
Alexey Khoroshilov <khoroshilov@ispras.ru>
Subject: Possible race in via-ircc.ko
Date: Tue, 15 Aug 2017 17:11:57 +0300 [thread overview]
Message-ID: <fa762133-a4d2-93ea-4ce9-24efbc067595@ispras.ru> (raw)
Hello.
While searching for races in the Linux kernel I've come across
"drivers/net/irda/via-ircc.ko" module. Here are questions that I came up
with while analyzing results. Lines are given using the info from Linux
v4.12.
Consider the following case:
Thread 1: Thread 2:
via_ircc_net_open
request_irq
<turn on interrupts>
via_ircc_interrupt
-> via_ircc_dma_receive -> RxTimerHandler
(via-ircc.c: line 1488) (via-ircc.c: line 1315)
self->... = ... ... = self->...
In the via_ircc_dma_receive a lot of fields of 'self' structure are
initialized and via_ircc_interrupt with RxTimerHandler use those fields.
If no initialization happened interrupt handler and other functions that
it calls may work with incorrect data. I'm not sure how bad this case
can be and thus here are my questions. Is this situation feasible from
your point of view? If it is feasible, is it a benign race or something
serious?
Thank you for your time.
-- Anton Volkov
Linux Verification Center, ISPRAS
web: http://linuxtesting.org
e-mail: avolkov@ispras.ru
reply other threads:[~2017-08-15 14:11 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=fa762133-a4d2-93ea-4ce9-24efbc067595@ispras.ru \
--to=avolkov@ispras.ru \
--cc=khoroshilov@ispras.ru \
--cc=ldv-project@linuxtesting.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=samuel@sortiz.org \
--cc=sda@bdit.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox