Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1751794AbdHAMjQ (ORCPT <rfc822;w@1wt.eu>);
        Tue, 1 Aug 2017 08:39:16 -0400
Received: from mail-vk0-f66.google.com ([209.85.213.66]:33243 "EHLO
        mail-vk0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751008AbdHAMjP (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Tue, 1 Aug 2017 08:39:15 -0400
MIME-Version: 1.0
In-Reply-To: <e93eb913-f3e4-081e-c4f7-92bcb99b83b6@ispras.ru>
References: <e93eb913-f3e4-081e-c4f7-92bcb99b83b6@ispras.ru>
From: Ming Lei <tom.leiming@gmail.com>
Date: Tue, 1 Aug 2017 20:39:13 +0800
Message-ID: <CACVXFVP-3gwmKkmATBUa=P-Tp1h1sZbZypfLkuOwDk60+E0PKQ@mail.gmail.com>
Subject: Re: Possible race in loop.ko
To: Anton Volkov <avolkov@ispras.ru>
Cc: Jens Axboe <axboe@fb.com>, Omar Sandoval <osandov@fb.com>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        ldv-project@linuxtesting.org,
        Alexey Khoroshilov <khoroshilov@ispras.ru>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Length: 1066
Lines: 29

On Fri, Jul 28, 2017 at 11:55 PM, Anton Volkov <avolkov@ispras.ru> wrote:
> Hello.
> While searching for races in Linux kernel I've come across
> drivers/block/loop.ko module. Here is the question that I came up with while
> analyzing results. Lines are given using the info from Linux v4.12.
>
> In loop_init function additional initialization happens after a successful
> call to misc_register() (loop.c: line 1961). Consider the following case:
>
> Thread 1:                 Thread 2:
> loop_init()
>   misc_register()         loop_control_ioctl
>   part_shift = 0          -> loop_add
>   if (max_part > 0) {          alloc_disk(1 << part_shift)
>     part_shift =
>          <greater than 0>
>     ...
>   }
>
> In this case alloc_disk() will be called with 1 as a parameter although
> part_shift should have been greater than 0. Maybe it would be better to move
> the call to a misc_register() function a bit further down (at least so it
> could be after the part_shift initialization)?

That looks a good idea, could you cook a patch to do it?


-- 
Ming Lei