lkml.org 
[lkml]   [2017]   [Aug]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectPossible race in c4.ko
Date
Hello.

While searching for races in the Linux kernel I've come across
"drivers/isdn/hardware/avm/c4.ko" module. Here is a question that I came
up with while analyzing results. Lines are given using the info from
Linux v4.12.

Consider the following case:

Thread 1: Thread 2:
c4_probe
->c4_add_card
request_irq()
c4_interrupt
->c4_handle_interrupt
->c4_handle_rx
card->cardnr = ... cidx = f(card->cardnr)
(c4.c: line 1227) (c4.c: line 526)
if (cidx >= card->nlogcontr) cidx = 0;
ctrl = &card->ctrlinfo[cidx].capi_ctrl

card->cardnr is 0 until it is initialized in c4_add_card(). If at the
moment of read access in c4_handle_rx() it is still 0, cidx may then be
assigned an undesirable value and wrong controller may handle messages.
Is this case feasible from your point of view?

Thank you for your time.

-- Anton Volkov
Linux Verification Center, ISPRAS
web: http://linuxtesting.org
e-mail: avolkov@ispras.ru

\
 
 \ /
  Last update: 2017-08-15 15:23    [W:0.055 / U:1.016 seconds]
©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site