From: Pavel Andrianov <andrianov-ufN2psIa012HXe+LvDLADg@public•gmane.org>
To: Dan Williams <dcbw-H+wXaHxf7aLQT0dZR+AlfA@public•gmane.org>
Cc: Kalle Valo <kvalo-sgV2jX0FEOL9JmXXK+q4OQ@public•gmane.org>,
libertas-dev-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r@public•gmane.org,
ldv-project-tpLiQldItUH5n4uC9ZG1Ww@public•gmane.org,
netdev-u79uwXL29TY76Z2rM5mHXA@public•gmane.org,
linux-wireless-u79uwXL29TY76Z2rM5mHXA@public•gmane.org,
linux-kernel-u79uwXL29TY76Z2rM5mHXA@public•gmane.org,
vaishali.thakkar-QHcLZuEGTsvQT0dZR+AlfA@public•gmane.org
Subject: Re: [ldv-project] [net] libertas: potential race condition
Date: Tue, 07 Jun 2016 18:54:23 +0400 [thread overview]
Message-ID: <5756E01F.6080107@ispras.ru> (raw)
In-Reply-To: <1465310395.29158.2.camel-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
07.06.2016 18:39, Dan Williams пишет:
> On Tue, 2016-06-07 at 13:30 +0400, Pavel Andrianov wrote:
>> Hi!
>>
>> There is a potential race condition in
>> drivers/net/wireless/libertas/libertas.ko.
>> In the function lbs_hard_start_xmit(..), line 159, a socket buffer
>> is
>> written to priv->current_skb with a spin_lock protection.
>> In the function lbs_mac_event_disconnected(..), lines 50-51, the
>> field
>> current_skb is cleaned. There is no protection used. The
>> corresponding
>> handlers are activated at the same time in lbs_start_card(..) and
>> then
>> may be executed simultaneously. Note, there are two structures
>> lbs_netdev_ops and mesh_netdev_ops, which have the target handler
>> lbs_hard_start_xmit.
>> Is it a real race or I have missed something?
> Yeah, it looks like it should be grabbing priv->driver_lock before
> clearing priv->currenttxskb in lbs_mac_event_disconnected(). Care to
> submit a patch after testing? Do you have any of that hardware?
>
> Dan
I have no that hardware and I have some doubts about the simple fix,
you've suggested. For instance, in lbs_hard_start_xmit the lock is
acquired twice and the priv->tx_pending_len can be modified also by
lbs_mac_event_disconnected (even if spin_lock will be added to
lbs_mac_event_disconnected). Moreover, the function lbs_send_tx_feedback
also cleaned priv->currenttxskb, but it happens also without any
protection. Thus, the fix has to be more complicated, and I have no
ideas about it.
--
Pavel Andrianov
Linux Verification Center, ISPRAS
web: http://linuxtesting.org
e-mail: andrianov-ufN2psIa012HXe+LvDLADg@public•gmane.org
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public•gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2016-06-07 14:54 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-06-07 9:30 [ldv-project] [net] libertas: potential race condition Pavel Andrianov
2016-06-07 14:39 ` Dan Williams
[not found] ` <1465310395.29158.2.camel-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2016-06-07 14:54 ` Pavel Andrianov [this message]
2016-06-07 22:51 ` James Cameron
2016-06-14 13:16 ` Pavel Andrianov
2016-06-15 0:46 ` James Cameron
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5756E01F.6080107@ispras.ru \
--to=andrianov-ufn2psia012hxe+lvdladg@public$(echo .)gmane.org \
--cc=dcbw-H+wXaHxf7aLQT0dZR+AlfA@public$(echo .)gmane.org \
--cc=kvalo-sgV2jX0FEOL9JmXXK+q4OQ@public$(echo .)gmane.org \
--cc=ldv-project-tpLiQldItUH5n4uC9ZG1Ww@public$(echo .)gmane.org \
--cc=libertas-dev-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r@public$(echo .)gmane.org \
--cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public$(echo .)gmane.org \
--cc=linux-wireless-u79uwXL29TY76Z2rM5mHXA@public$(echo .)gmane.org \
--cc=netdev-u79uwXL29TY76Z2rM5mHXA@public$(echo .)gmane.org \
--cc=vaishali.thakkar-QHcLZuEGTsvQT0dZR+AlfA@public$(echo .)gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox