From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1751973AbdHHEKe (ORCPT <rfc822;w@1wt.eu>);
        Tue, 8 Aug 2017 00:10:34 -0400
Received: from bh-25.webhostbox.net ([208.91.199.152]:36485 "EHLO
        bh-25.webhostbox.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1750727AbdHHEKd (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Tue, 8 Aug 2017 00:10:33 -0400
Subject: Re: Possible race in pc87413_wdt.ko
To: Anton Volkov <avolkov@ispras.ru>, wim@iguana.be
Cc: linux-watchdog@vger.kernel.org, linux-kernel@vger.kernel.org,
        ldv-project@linuxtesting.org,
        Alexey Khoroshilov <khoroshilov@ispras.ru>
References: <da42be1b-f442-6294-a163-84e1b971a651@ispras.ru>
From: Guenter Roeck <linux@roeck-us.net>
Message-ID: <41535b54-6d50-fad8-139c-c6f569ffc89e@roeck-us.net>
Date: Mon, 7 Aug 2017 21:10:29 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.2.1
MIME-Version: 1.0
In-Reply-To: <da42be1b-f442-6294-a163-84e1b971a651@ispras.ru>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
X-Authenticated_sender: linux@roeck-us.net
X-OutGoing-Spam-Status: No, score=-1.0
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - bh-25.webhostbox.net
X-AntiAbuse: Original Domain - vger.kernel.org
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - roeck-us.net
X-Get-Message-Sender-Via: bh-25.webhostbox.net: authenticated_id: linux@roeck-us.net
X-Authenticated-Sender: bh-25.webhostbox.net: linux@roeck-us.net
X-Source: 
X-Source-Args: 
X-Source-Dir: 
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 08/07/2017 06:22 AM, Anton Volkov wrote:
> Hello.
> 
> While searching for races in the Linux kernel I've come across "drivers/watchdog/pc87413_wdt.ko" module. Here is a question that I came up with while analyzing results. Lines are given using the info from Linux v4.12.
> 
> Consider the following case:
> 
> Thread 1:                          Thread 2:
> pc87413_init
>     misc_register(&pc87413_miscdev)
> -> pc87413_get_swc_base_addr       pc87413_open
>                                     -> pc87413_refresh
>                                        -> pc87413_swc_bank3
>       swc_base_addr = ...                  <read access to swc_base_addr>
>       (pc87413_wdt.c: line 133)            (pc87413_wdt.c: line 146)
> 
> So in this case preemptive registration of the device leads to a possibility of race between the initialization process and a callback to the registered device.
> 
> Is this race feasible from your point of view? And if it is, is it possible to move the device registration a bit further down in the pc87413_init function?
> 

Yes, the race is feasible, and it is possible to move the device registration function
(though the preferred solution would be to convert the driver to use the watchdog
subsystem). The code looks pretty bad as written.

Just not sure if it is worth bothering about it. I suspect no on is using that driver
anymore (the datasheet is from 2001). Might as well just declare it obsolete and
wait for someone to scream.

Guenter