kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
linux/drivers/isdn/mISDN
History
Eric Dumazet 7ac345a93a mISDN: annotate data-race around dev->work 
[ Upstream commit 8175dbf174 ]

dev->work can re read locklessly in mISDN_read()
and mISDN_poll(). Add READ_ONCE()/WRITE_ONCE() annotations.

BUG: KCSAN: data-race in mISDN_ioctl / mISDN_read

write to 0xffff88812d848280 of 4 bytes by task 10864 on cpu 1:
  misdn_add_timer drivers/isdn/mISDN/timerdev.c:175 [inline]
  mISDN_ioctl+0x2fb/0x550 drivers/isdn/mISDN/timerdev.c:233
  vfs_ioctl fs/ioctl.c:51 [inline]
  __do_sys_ioctl fs/ioctl.c:597 [inline]
  __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583
  __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583
  x64_sys_call+0x14b0/0x3000 arch/x86/include/generated/asm/syscalls_64.h:17
  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
  do_syscall_64+0xd8/0x2c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88812d848280 of 4 bytes by task 10857 on cpu 0:
  mISDN_read+0x1f2/0x470 drivers/isdn/mISDN/timerdev.c:112
  do_loop_readv_writev fs/read_write.c:847 [inline]
  vfs_readv+0x3fb/0x690 fs/read_write.c:1020
  do_readv+0xe7/0x210 fs/read_write.c:1080
  __do_sys_readv fs/read_write.c:1165 [inline]
  __se_sys_readv fs/read_write.c:1162 [inline]
  __x64_sys_readv+0x45/0x50 fs/read_write.c:1162
  x64_sys_call+0x2831/0x3000 arch/x86/include/generated/asm/syscalls_64.h:20
  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
  do_syscall_64+0xd8/0x2c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000000 -> 0x00000001

Fixes: 1b2b03f8e5 ("Add mISDN core files")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260118132528.2349573-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-01-30 10:32:18 +01:00
..
clock.c isdn: replace deprecated strncpy with strscpy 2023-10-02 11:07:02 -07:00
core.c isdn: Remove unused get_Bprotocol4id() 2024-12-11 20:12:27 -08:00
core.h isdn: Remove unused get_Bprotocol4id() 2024-12-11 20:12:27 -08:00
dsp.h mISDN: Update parameter type of dsp_cmx_send() 2023-08-03 18:08:32 -07:00
dsp_audio.c isdn: Remove reverse_bits(), use revbit8() 2015-08-10 14:29:04 -07:00
dsp_biquad.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61 2019-05-24 17:36:45 +02:00
dsp_blowfish.c mISDN: remove unused struct 'bf_ctx' 2024-05-27 16:48:00 -07:00
dsp_cmx.c treewide: Fix wrong singular form of jiffies in comments 2024-09-08 20:47:40 +02:00
dsp_core.c treewide: Switch/rename to timer_delete[_sync]() 2025-04-05 10:30:12 +02:00
dsp_dtmf.c mISDN: Fix division by zero 2012-04-26 03:10:45 -04:00
dsp_ecdis.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61 2019-05-24 17:36:45 +02:00
dsp_hwec.c mISDN: Fix memory leak in dsp_hwec_enable() 2025-08-29 19:19:39 -07:00
dsp_hwec.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
dsp_pipeline.c isdn: mISDN: make elements_class constant 2024-03-07 20:26:24 -08:00
dsp_tones.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
fsm.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
fsm.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174 2019-05-30 11:26:41 -07:00
hwchannel.c idsn: Use pr_warn instead of pr_warning 2019-10-18 15:00:21 +02:00
Kconfig misdn: dsp: select CONFIG_BITREVERSE 2021-01-05 15:50:36 -08:00
l1oip.h mISDN: fix use-after-free bugs in l1oip timer handlers 2022-09-30 12:32:42 +01:00
l1oip_codec.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 153 2019-05-30 11:26:32 -07:00
l1oip_core.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
layer1.c mISDN: change function names to avoid conflicts 2021-12-28 12:12:04 +00:00
layer1.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174 2019-05-30 11:26:41 -07:00
layer2.c mISDN: Delete unnecessary checks before the macro call “dev_kfree_skb” 2019-08-22 16:22:03 -07:00
layer2.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174 2019-05-30 11:26:41 -07:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
socket.c mISDN: fix MISDN_TIME_STAMP handling 2024-04-09 17:01:01 -07:00
stack.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
tei.c mISDN: Delete unnecessary checks before the macro call “dev_kfree_skb” 2019-08-22 16:22:03 -07:00
timerdev.c mISDN: annotate data-race around dev->work 2026-01-30 10:32:18 +01:00