Re: [PATCH net] mISDN: Fix data race in timer handling

+ Eric

On Tue, Jan 27, 2026 at 02:19:27AM -0500, Henry Zhang wrote:

KCSAN reported a data race where misdn_add_timer() writes dev->work
while mISDN_read() reads it without holding the spinlock:

write to 0xffff88812d848280 of 4 bytes by task 10864 on cpu 1:
 misdn_add_timer drivers/isdn/mISDN/timerdev.c:175 [inline]
...

read to 0xffff88812d848280 of 4 bytes by task 10857 on cpu 0:
 mISDN_read+0x1f2/0x470 drivers/isdn/mISDN/timerdev.c:112
...

dev->work is read locklessly in wait_event_interruptible() and
mISDN_poll(). In mISDN_read(), the result is rechecked under dev->lock.
In mISDN_poll(), a stale value may cause a spurious EPOLLIN or a missed
wake, but wake_up_interruptible() will correct this. In both cases, the
race is benign, so we can annotate these with READ_ONCE/WRITE_ONCE.

Reported-by: syzbot+c6e7bcea7ffb7ff46acb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c6e7bcea7ffb7ff46acb

Signed-off-by: Henry Zhang <redacted>

Hi Henry,

This appears to already be addressed by
commit 8175dbf174d4 ("mISDN: annotate data-race around dev->work")

-- 
pw-bot: cr