Thread (2 messages) flat view 2 messages, 2 authors, 2021-08-17

[question] potential race between capinc_tty_init & capi_release

From: Saubhik Mukherjee <hidden>
Date: 2021-08-17 09:13:33
Also in: lkml

In drivers/isdn/capi/capi.c, based on the output of a static analysis 
tool, we found the possibility of the following race condition:

In capi_init, register_chrdev registers file operations callbacks, 
capi_fops. Then capinc_tty_init is executed.

Simultaneously the following chain of calls can occur (after a 
successful capi_open call).

capi_release -> capincci_free -> capincci_free_minor -> capiminor_free 
-> tty_unregister_device

tty_unregister_device reads capinc_tty_driver, which might not have been 
initialized at this point. So, we have a race between capi_release and 
capinc_tty_init.

If this is a possible race scenario, maybe moving register_chrdev after 
capinc_tty_init could fix it. But I am not sure if this will break 
something else. Please let me know if this is a potential race and can 
be fixed as mentioned.

Since this is based on a static analysis tool, this is not tested.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help