linux-kernel - A potential race in drivers/scsi/megaraid.ko

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Fri, 12 Aug 2016 13:44:18 +0300
From:	Pavel Andrianov <andrianov@...ras.ru>
To:	Kashyap Desai <kashyap.desai@...gotech.com>
Cc:	Sumit Saxena <sumit.saxena@...gotech.com>,
	Uday Lingala <uday.lingala@...gotech.com>,
	"James E.J. Bottomley" <jejb@...ux.vnet.ibm.com>,
	"Martin K. Petersen" <martin.petersen@...cle.com>,
	megaraidlinux.pdl@...gotech.com, linux-scsi@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Vaishali Thakkar <vaishali.thakkar@...cle.com>,
	ldv-project@...uxtesting.org
Subject: A potential race in drivers/scsi/megaraid.ko

Hi!

There is a potential data race in drivers/scsi/megaraid.ko
Regards such case:

Thread 1					Thread 2
...						...
-> megaraid_probe_one				
    -> request_irq    - now an interrupt may arise
    -> mega_query_adapter
      -> issue_scb_block
			interrupt comes 	
						-> megaraid_isr_iomapped
						  -> mega_runpendq
						    -> __mega_runpendq
						      -> issue_skb

In this case the structure 'mbox' is modified from two threads 
simultaneously. Or, more correct, the first modification is interrupted 
by the second one. Likely, the first thread should acquire the same 
spinlock adapter->lock as the second one.

-- 
Pavel Andrianov
Linux Verification Center, ISPRAS
web: http://linuxtesting.org
e-mail: andrianov@...ras.ru