Bug 217614 - [BUG] [media] dvb-usb: possible data-inconsistency due to data races in dib0700_rc_query_old_firmware()
Summary: [BUG] [media] dvb-usb: possible data-inconsistency due to data races in dib07...
Status: NEW
Alias: None
Product: Drivers
Classification: Unclassified
Component: USB (show other bugs)
Hardware: All Linux
: P3 normal
Assignee: Default virtual assignee for Drivers/USB
URL:
Keywords:
: 217613 (view as bug list)
Depends on:
Blocks:
 
Reported: 2023-06-30 01:38 UTC by Tuo Li
Modified: 2023-06-30 01:50 UTC (History)
1 user (show)

See Also:
Kernel Version: 6.4.0
Subsystem:
Regression: No
Bisected commit-id:


Attachments

Description Tuo Li 2023-06-30 01:38:08 UTC
Our static analysis tool finds some possible data races in the
DVB USB driver in Linux 6.4.0.

The variable d->priv->buf is often accessed with holding the
lock d->usb_mutex, here is an example:

  dib0700_change_protocol()  --> Line 638 in dib0700_core.c
    st = d->priv;  --> Line 641 in dib0700_core.c (Alias)
    mutex_lock_interruptible(&d->usb_mutex)
               --> Line 644 in dib0700_core.c (Lock d->usb_mutex)
    st->buf[0] = REQUEST_SET_RC;
               --> Line 649 in dib0700_core.c (Access d->priv->buf)

However, in the function dib0700_rc_query_old_firmware(), the
variable d->priv->buf is accessed without holding the lock
d->usb_mutex:

  dib0700_rc_query_old_firmware()  --> Line 516 in dib0700_devices.c
    st = d->priv;  --> Line 522 in dib0700_devices.c (Alias)
    st->buf[0] = REQUEST_POLL_RC;
               --> Line 532 in dib0700_devices.c (Access st->buf)

And thus harmful data races can occur because they can make
data in st-buf inconsistent.

I am not quite sure whether these possible data races are real and
how to fix them if they are real.

Any feedback would be appreciated, thanks!

Reported-by: BassCheck <bass@buaa.edu.cn>
Comment 1 Tuo Li 2023-06-30 01:48:35 UTC
*** Bug 217613 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.