Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
From:   Madhuparna Bhowmik <madhuparnabhowmik10@gmail.com>
Date:   Wed, 22 Jul 2020 03:00:49 +0530
Message-ID: <CAD=jOEYzbemo=WBev97q36578h5VA7jYVAdewgf5vKycGP1y+g@mail.gmail.com>
Subject: Regarding bug in phantom.c
To:     jirislaby@gmail.com, arnd@arndb.de
Cc:     andrianov <andrianov@ispras.ru>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Hi,

This is regarding a race-condition related bug found in phantom.c by
the Linux Driver Verification Project.

dev->status is accessed in phantom_release with dev->open_lock and in
phantom_isr() using dev->regs_lock therefore there can be a race
between updating dev->status in phantom_release() and phantom_status()
and reading it's value in phantom_isr().
I don't think there is any particular lock protecting dev->status
(like open_lock and regs_lock are for dev->opened and dev->oregs) and
also not sure why exactly dev->status is updated in phantom_status()
and just after that updated again in phantom_release().
It will be great if you could look into this bug.

Thank you,
Madhuparna