From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1752492AbcHLJyh (ORCPT <rfc822;w@1wt.eu>);
	Fri, 12 Aug 2016 05:54:37 -0400
Received: from mail.ispras.ru ([83.149.199.45]:54706 "EHLO mail.ispras.ru"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1751230AbcHLJyK (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
	Fri, 12 Aug 2016 05:54:10 -0400
From: Pavel Andrianov <andrianov@ispras.ru>
Subject: A potential data race in drivers/net/ethernet/smsc/smc91c92_cs.ko
To: Felipe Balbi <felipe.balbi@linux.intel.com>,
        Mugunthan V N <mugunthanvnm@ti.com>
Cc: Antonio Quartulli <a@unstable.cc>, Florian Westphal <fw@strlen.de>,
        "David S. Miller" <davem@davemloft.net>, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org,
        Vaishali Thakkar <vaishali.thakkar@oracle.com>,
        ldv-project@linuxtesting.org
Message-ID: <f6391dbe-c692-d88c-9877-79270fce397b@ispras.ru>
Date: Fri, 12 Aug 2016 12:54:07 +0300
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
 Thunderbird/45.2.0
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi!

There is a potential data race in drivers/net/ethernet/smsc/smc91c92_cs.ko.
Regard two threads:

Thread 1 			Thread 2
				...
...				->smc_open
->smc_tx_timeout		  ->mod_timer 	
   -> smc_reset			    ->media_check - timer function
     -> smc_set_xcvr		      ->smc_set_xcvr	

In this case the struct 'smc' is modified from two threads 
simultaneously. Likely, the first thread should acquire the same 
spinlock smc->lock as the second thread in media_check.

-- 
Pavel Andrianov
Linux Verification Center, ISPRAS
web: http://linuxtesting.org
e-mail: andrianov@ispras.ru