From: Anton Volkov <avolkov@ispras.ru>
Subject: Possible race in ks8851_mll.ko
To: david.choi@micrel.com, davem@davemloft.net
Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
        ldv-project@linuxtesting.org,
        Alexey Khoroshilov <khoroshilov@ispras.ru>
Message-ID: <49e80d06-531e-178e-1cb0-3293f275847f@ispras.ru>
Date: Tue, 15 Aug 2017 18:57:32 +0300
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.2.1
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1156
Lines: 32

Hello.

While searching for races in the Linux kernel I've come across
"drivers/net/ethernet/micrel/ks8851_mll.ko" module. Here is a question 
that I came up with while analyzing results. Lines are given using the 
info from Linux v4.12.

Consider the following case:

Thread 1:                    Thread 2:
ks8851_probe
   ks = netdev_priv(netdev)
   register_netdev
                              ks_start_xmit
->ks_soft_reset              ->ks_tx_fifo_space
   ->ks_wrreg16                 ->ks_rdreg16
       ks->cmd_reg_cache = ...      ks->cmd_reg_cache = ...
       (ks8851_mll.c: line 536)     (ks8851_mll.c: line 505)
       iowrite16(ks->cmd_reg_cache) iowrite16(ks->cmd_reg_cache)

In this case early registration of netdev leads to callback interference 
in the initialization process. Both ks_wrreg16() and ks_rdreg16() use 
the same ks. If one of them changes the ks->cmd_reg_cache it is possible 
that both will use the same value though it should be different. Is this 
race feasible from your point of view?

Thank you for your time.

-- Anton Volkov
Linux Verification Center, ISPRAS
web: http://linuxtesting.org
e-mail: avolkov@ispras.ru