In drivers/isdn/capi/capi.c, based on the output of a static analysis
tool, we found the possibility of the following race condition:
In capi_init, register_chrdev registers file operations callbacks,
capi_fops. Then capinc_tty_init is executed.
Simultaneously the following chain of calls can occur (after a
successful capi_open call).
capi_release -> capincci_free -> capincci_free_minor -> capiminor_free
-> tty_unregister_device
tty_unregister_device reads capinc_tty_driver, which might not have been
initialized at this point. So, we have a race between capi_release and
capinc_tty_init.
If this is a possible race scenario, maybe moving register_chrdev after
capinc_tty_init could fix it. But I am not sure if this will break
something else. Please let me know if this is a potential race and can
be fixed as mentioned.
Since this is based on a static analysis tool, this is not tested.
On Tue, Aug 17, 2021 at 02:43:22PM +0530, Saubhik Mukherjee wrote:
> In drivers/isdn/capi/capi.c, based on the output of a static analysis tool,
> we found the possibility of the following race condition:
Do you know of any isdn capi devices out there in the world right now?
>
> In capi_init, register_chrdev registers file operations callbacks,
> capi_fops. Then capinc_tty_init is executed.
>
> Simultaneously the following chain of calls can occur (after a successful
> capi_open call).
>
> capi_release -> capincci_free -> capincci_free_minor -> capiminor_free ->
> tty_unregister_device
>
> tty_unregister_device reads capinc_tty_driver, which might not have been
> initialized at this point. So, we have a race between capi_release and
> capinc_tty_init.
>
> If this is a possible race scenario, maybe moving register_chrdev after
> capinc_tty_init could fix it. But I am not sure if this will break something
> else. Please let me know if this is a potential race and can be fixed as
> mentioned.
Would you be racing now if someone opened/closed the tty device node
before the char device node was created?
Anyway, this is really old and obsolete code, odds are it can just be
removed entirely.
thanks,
greg k-h