A potential race in drivers/scsi/megaraid.ko

From	Pavel Andrianov <andrianov@ispras.ru>
Newsgroups	linux.kernel
Subject	A potential race in drivers/scsi/megaraid.ko
Date	2016-08-12 13:00 +0200
Message-ID	<s5ilY-yH-13@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

Hi!

There is a potential data race in drivers/scsi/megaraid.ko
Regards such case:

Thread 1					Thread 2
...						...
-> megaraid_probe_one				
    -> request_irq    - now an interrupt may arise
    -> mega_query_adapter
      -> issue_scb_block
			interrupt comes 	
						-> megaraid_isr_iomapped
						  -> mega_runpendq
						    -> __mega_runpendq
						      -> issue_skb

In this case the structure 'mbox' is modified from two threads 
simultaneously. Or, more correct, the first modification is interrupted 
by the second one. Likely, the first thread should acquire the same 
spinlock adapter->lock as the second one.

-- 
Pavel Andrianov
Linux Verification Center, ISPRAS
web: http://linuxtesting.org
e-mail: andrianov@ispras.ru

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

A potential race in drivers/scsi/megaraid.ko Pavel Andrianov <andrianov@ispras.ru> - 2016-08-12 13:00 +0200

csiph-web