2017-08-15 15:57:36

by Anton Volkov

[permalink] [raw]
Subject: Possible race in ks8851_mll.ko

Hello.

While searching for races in the Linux kernel I've come across
"drivers/net/ethernet/micrel/ks8851_mll.ko" module. Here is a question
that I came up with while analyzing results. Lines are given using the
info from Linux v4.12.

Consider the following case:

Thread 1: Thread 2:
ks8851_probe
ks = netdev_priv(netdev)
register_netdev
ks_start_xmit
->ks_soft_reset ->ks_tx_fifo_space
->ks_wrreg16 ->ks_rdreg16
ks->cmd_reg_cache = ... ks->cmd_reg_cache = ...
(ks8851_mll.c: line 536) (ks8851_mll.c: line 505)
iowrite16(ks->cmd_reg_cache) iowrite16(ks->cmd_reg_cache)

In this case early registration of netdev leads to callback interference
in the initialization process. Both ks_wrreg16() and ks_rdreg16() use
the same ks. If one of them changes the ks->cmd_reg_cache it is possible
that both will use the same value though it should be different. Is this
race feasible from your point of view?

Thank you for your time.

-- Anton Volkov
Linux Verification Center, ISPRAS
web: http://linuxtesting.org
e-mail: [email protected]