From: Johan Hovold <johan@kernel.org>
To: Saubhik Mukherjee <saubhik.mukherjee@gmail.com>
Cc: Greg KH <gregkh@linuxfoundation.org>,
jirislaby@kernel.org, linux-serial@vger.kernel.org,
linux-kernel@vger.kernel.org, ldv-project@linuxtesting.org,
andrianov@ispras.ru
Subject: Re: [PATCH] tty: serial: owl: Fix data race in owl_uart_remove
Date: Wed, 23 Jun 2021 09:16:20 +0200 [thread overview]
Message-ID: <YNLfxMZZ0a80qKLg@hovoldconsulting.com> (raw)
In-Reply-To: <ceebf511-9971-6deb-a6dd-458d69de2bbd@gmail.com>
On Wed, Jun 23, 2021 at 11:06:53AM +0530, Saubhik Mukherjee wrote:
> On 6/17/21 4:52 PM, Greg KH wrote:
> > On Thu, Jun 17, 2021 at 04:34:43PM +0530, Saubhik Mukherjee wrote:
> >> Suppose the driver is registered and a UART port is added. Once an
> >> application opens the port, owl_uart_startup is called which registers
> >> the interrupt handler owl_uart_irq.
> >>
> >> We could have the following race condition:
> >>
> >> When device is removed, owl_uart_remove is called, which calls
> >> uart_remove_one_port, which calls owl_uart_release_port, which writes
> >> NULL to port->membase. At this point parallely, an interrupt could be
> >> handled by owl_uart_irq which reads port->membase.
> >>
> >> This is because it is possible to remove device without closing a port.
> >> Thus, we need to check it and call owl_uart_shutdown in owl_uart_remove.
No, this makes no sense at all. The port is deregistered and hung up by
uart_remove_one_port() (and the interrupt line is consequently disabled
by the driver) before it is released so this can never happen.
> >> Found by Linux Driver Verification project (linuxtesting.org).
And you clearly did not test this, which you should mention.
Johan
next prev parent reply other threads:[~2021-06-23 7:16 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-17 11:04 [PATCH] tty: serial: owl: Fix data race in owl_uart_remove Saubhik Mukherjee
2021-06-17 11:22 ` Greg KH
2021-06-23 5:36 ` Saubhik Mukherjee
2021-06-23 7:16 ` Johan Hovold [this message]
2021-06-24 12:07 ` Saubhik Mukherjee
2021-06-24 12:29 ` Johan Hovold
2021-06-25 7:52 ` Saubhik Mukherjee
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YNLfxMZZ0a80qKLg@hovoldconsulting.com \
--to=johan@kernel.org \
--cc=andrianov@ispras.ru \
--cc=gregkh@linuxfoundation.org \
--cc=jirislaby@kernel.org \
--cc=ldv-project@linuxtesting.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-serial@vger.kernel.org \
--cc=saubhik.mukherjee@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.