Hello.
While searching for races in the Linux kernel I've come across
"drivers/isdn/hardware/avm/c4.ko" module. Here is a question that I came
up with while analyzing results. Lines are given using the info from
Linux v4.12.
Consider the following case:
Thread 1: Thread 2:
c4_probe
->c4_add_card
request_irq()
c4_interrupt
->c4_handle_interrupt
->c4_handle_rx
card->cardnr = ... cidx = f(card->cardnr)
(c4.c: line 1227) (c4.c: line 526)
if (cidx >= card->nlogcontr) cidx = 0;
ctrl = &card->ctrlinfo[cidx].capi_ctrl
card->cardnr is 0 until it is initialized in c4_add_card(). If at the
moment of read access in c4_handle_rx() it is still 0, cidx may then be
assigned an undesirable value and wrong controller may handle messages.
Is this case feasible from your point of view?
Thank you for your time.
-- Anton Volkov
Linux Verification Center, ISPRAS
web: http://linuxtesting.org
e-mail: avol...@ispras.ru
