archive mirror
 help / color / mirror / Atom feed
From: Greg KH <>
To: Saubhik Mukherjee <>
Subject: Re: [question] potential race between capinc_tty_init & capi_release
Date: Tue, 17 Aug 2021 18:28:05 +0200	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

On Tue, Aug 17, 2021 at 02:43:22PM +0530, Saubhik Mukherjee wrote:
> In drivers/isdn/capi/capi.c, based on the output of a static analysis tool,
> we found the possibility of the following race condition:

Do you know of any isdn capi devices out there in the world right now?

> In capi_init, register_chrdev registers file operations callbacks,
> capi_fops. Then capinc_tty_init is executed.
> Simultaneously the following chain of calls can occur (after a successful
> capi_open call).
> capi_release -> capincci_free -> capincci_free_minor -> capiminor_free ->
> tty_unregister_device
> tty_unregister_device reads capinc_tty_driver, which might not have been
> initialized at this point. So, we have a race between capi_release and
> capinc_tty_init.
> If this is a possible race scenario, maybe moving register_chrdev after
> capinc_tty_init could fix it. But I am not sure if this will break something
> else. Please let me know if this is a potential race and can be fixed as
> mentioned.

Would you be racing now if someone opened/closed the tty device node
before the char device node was created?

Anyway, this is really old and obsolete code, odds are it can just be
removed entirely.


greg k-h

      reply	other threads:[~2021-08-17 16:31 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-08-17  9:13 [question] potential race between capinc_tty_init & capi_release Saubhik Mukherjee
2021-08-17 16:28 ` Greg KH [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).