* A potential race in drivers/staging/speakup/speakup.ko
@ 2016-09-05 8:51 Pavel Andrianov
2016-09-05 9:43 ` Samuel Thibault
0 siblings, 1 reply; 6+ messages in thread
From: Pavel Andrianov @ 2016-09-05 8:51 UTC (permalink / raw)
To: William Hubbs
Cc: Chris Brannon, Kirk Reiser, Samuel Thibault, speakup, devel,
linux-kernel, Vaishali Thakkar, ldv-project
Hi!
There is a potential race in drivers/staging/speakup/speakup.ko.
All operations with global pointers buff_in and buff_out are performed
without any locks. Thus, a simultaneous write (via synth_buffer_clear or
synth_buffer_add) to the pointers may lead to inconsistent data.
Should a local lock be used here?
--
Pavel Andrianov
Linux Verification Center, ISPRAS
web: http://linuxtesting.org
e-mail: andrianov@ispras.ru
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: A potential race in drivers/staging/speakup/speakup.ko
2016-09-05 8:51 A potential race in drivers/staging/speakup/speakup.ko Pavel Andrianov
@ 2016-09-05 9:43 ` Samuel Thibault
2016-09-05 9:54 ` Pavel Andrianov
0 siblings, 1 reply; 6+ messages in thread
From: Samuel Thibault @ 2016-09-05 9:43 UTC (permalink / raw)
To: Pavel Andrianov
Cc: William Hubbs, Chris Brannon, Kirk Reiser, speakup, devel,
linux-kernel, Vaishali Thakkar, ldv-project
Hello,
Pavel Andrianov, on Mon 05 Sep 2016 11:51:50 +0300, wrote:
> There is a potential race in drivers/staging/speakup/speakup.ko.
> All operations with global pointers buff_in and buff_out are performed
> without any locks. Thus, a simultaneous write (via synth_buffer_clear or
> synth_buffer_add) to the pointers may lead to inconsistent data.
>
> Should a local lock be used here?
AIUI, all callers of these functions have speakup_info.spinlock held.
Samuel
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: A potential race in drivers/staging/speakup/speakup.ko
2016-09-05 9:43 ` Samuel Thibault
@ 2016-09-05 9:54 ` Pavel Andrianov
2016-09-05 9:56 ` Samuel Thibault
0 siblings, 1 reply; 6+ messages in thread
From: Pavel Andrianov @ 2016-09-05 9:54 UTC (permalink / raw)
To: Samuel Thibault, William Hubbs, Chris Brannon, Kirk Reiser,
speakup, devel, linux-kernel, Vaishali Thakkar, ldv-project
05.09.2016 12:43, Samuel Thibault пишет:
> Hello,
>
> Pavel Andrianov, on Mon 05 Sep 2016 11:51:50 +0300, wrote:
>> There is a potential race in drivers/staging/speakup/speakup.ko.
>> All operations with global pointers buff_in and buff_out are performed
>> without any locks. Thus, a simultaneous write (via synth_buffer_clear or
>> synth_buffer_add) to the pointers may lead to inconsistent data.
>>
>> Should a local lock be used here?
>
> AIUI, all callers of these functions have speakup_info.spinlock held.
>
> Samuel
>
Regard a call stack
-> synth_direct_store
-> synth_printf
-> synth_buffer_add
The functions have not held speakup_info.spinlock.
--
Pavel Andrianov
Linux Verification Center, ISPRAS
web: http://linuxtesting.org
e-mail: andrianov@ispras.ru
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: A potential race in drivers/staging/speakup/speakup.ko
2016-09-05 9:54 ` Pavel Andrianov
@ 2016-09-05 9:56 ` Samuel Thibault
2016-09-05 10:33 ` Pavel Andrianov
0 siblings, 1 reply; 6+ messages in thread
From: Samuel Thibault @ 2016-09-05 9:56 UTC (permalink / raw)
To: Pavel Andrianov
Cc: William Hubbs, Chris Brannon, Kirk Reiser, speakup, devel,
linux-kernel, Vaishali Thakkar, ldv-project
Pavel Andrianov, on Mon 05 Sep 2016 12:54:10 +0300, wrote:
> 05.09.2016 12:43, Samuel Thibault пишет:
> >Pavel Andrianov, on Mon 05 Sep 2016 11:51:50 +0300, wrote:
> >>There is a potential race in drivers/staging/speakup/speakup.ko.
> >>All operations with global pointers buff_in and buff_out are performed
> >>without any locks. Thus, a simultaneous write (via synth_buffer_clear or
> >>synth_buffer_add) to the pointers may lead to inconsistent data.
> >>
> >>Should a local lock be used here?
> >
> >AIUI, all callers of these functions have speakup_info.spinlock held.
>
> Regard a call stack
>
> -> synth_direct_store
> -> synth_printf
> -> synth_buffer_add
>
> The functions have not held speakup_info.spinlock.
Apparently there is currently no caller of synth_direct_store and
synth_store. But taking the lock here would be needed indeed.
Samuel
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: A potential race in drivers/staging/speakup/speakup.ko
2016-09-05 9:56 ` Samuel Thibault
@ 2016-09-05 10:33 ` Pavel Andrianov
2016-09-05 10:38 ` Samuel Thibault
0 siblings, 1 reply; 6+ messages in thread
From: Pavel Andrianov @ 2016-09-05 10:33 UTC (permalink / raw)
To: Samuel Thibault, William Hubbs, Chris Brannon, Kirk Reiser,
speakup, devel, linux-kernel, Vaishali Thakkar, ldv-project
05.09.2016 12:56, Samuel Thibault пишет:
> Pavel Andrianov, on Mon 05 Sep 2016 12:54:10 +0300, wrote:
>> 05.09.2016 12:43, Samuel Thibault пишет:
>>> Pavel Andrianov, on Mon 05 Sep 2016 11:51:50 +0300, wrote:
>>>> There is a potential race in drivers/staging/speakup/speakup.ko.
>>>> All operations with global pointers buff_in and buff_out are performed
>>>> without any locks. Thus, a simultaneous write (via synth_buffer_clear or
>>>> synth_buffer_add) to the pointers may lead to inconsistent data.
>>>>
>>>> Should a local lock be used here?
>>>
>>> AIUI, all callers of these functions have speakup_info.spinlock held.
>>
>> Regard a call stack
>>
>> -> synth_direct_store
>> -> synth_printf
>> -> synth_buffer_add
>>
>> The functions have not held speakup_info.spinlock.
>
> Apparently there is currently no caller of synth_direct_store and
> synth_store. But taking the lock here would be needed indeed.
>
> Samuel
>
synth_direct_store may be called via device_attributes interface. In
which function the lock should be added?
--
Pavel Andrianov
Linux Verification Center, ISPRAS
web: http://linuxtesting.org
e-mail: andrianov@ispras.ru
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: A potential race in drivers/staging/speakup/speakup.ko
2016-09-05 10:33 ` Pavel Andrianov
@ 2016-09-05 10:38 ` Samuel Thibault
0 siblings, 0 replies; 6+ messages in thread
From: Samuel Thibault @ 2016-09-05 10:38 UTC (permalink / raw)
To: Pavel Andrianov
Cc: William Hubbs, Chris Brannon, Kirk Reiser, speakup, devel,
linux-kernel, Vaishali Thakkar, ldv-project
Pavel Andrianov, on Mon 05 Sep 2016 13:33:33 +0300, wrote:
> synth_direct_store may be called via device_attributes interface.
Ah, right.
> In which function the lock should be added?
That'd be synth_direct_store then, around the while loop.
Samuel
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-09-05 10:38 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-09-05 8:51 A potential race in drivers/staging/speakup/speakup.ko Pavel Andrianov
2016-09-05 9:43 ` Samuel Thibault
2016-09-05 9:54 ` Pavel Andrianov
2016-09-05 9:56 ` Samuel Thibault
2016-09-05 10:33 ` Pavel Andrianov
2016-09-05 10:38 ` Samuel Thibault
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®