executed.
Should the registration of net device be at the end of dwceqos_probe?
--
Pavel Andrianov
Linux Verification Center, ISPRAS
web: http://linuxtesting.org
e-mail: andria...@ispras.ru
smc_reset may be executed in parallel with timer function media_check.
To avoid data race in smc_set_xcvr a spinlock was added.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Pavel Andrianov <andria...@ispras.ru>
---
drivers/net/ethernet/smsc/smc91c92_cs
are registered in divas_maint_register_chrdev, which is called
(divamnt.c: line 206) before initialization (divamnt.c: line 211). Thus,
there may occur a situation when the handlers of divas_main_fops occur
to uninitialized resources.
--
Pavel Andrianov
Linux Verification Center, ISPRAS
web
free_skb(skb)
In this case the skb is freed twice. Likely, in the interrupt handler
the same spinlock should be acquired as in
sis190_tx_timeout.
--
Pavel Andrianov
Linux Verification Center, ISPRAS
web: http://linuxtesting.org
e-mail: andria...@ispras.ru
t; smc_reset ->media_check - timer function
-> smc_set_xcvr->smc_set_xcvr
In this case the struct 'smc' is modified from two threads
simultaneously. Likely, the first thread should acquire the same
spinlock smc->lock as the second thread in
. Thus, the interrupt may occur while initialization is not
finishing and the new value of events will be lost. Moreover, the
spinlock, which is used in the interrupt handler, is also initialized
(line 1842) after request_irq (line 1813).
--
Pavel Andrianov
Linux Verification Center, ISPRAS
web
Verification project (linuxtesting.org)
Signed-off-by: Pavel Andrianov <andria...@ispras.ru>
---
drivers/net/wireless/wl3501_cs.c | 7 +++
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c
index 13fd734..1
lbs_mac_event_disconnected may free priv->currenttxskb
while lbs_hard_start_xmit accesses to it.
The patch adds a spinlock for mutual exclusion.
Tested on OLPC XO-1 (usb8388) and XO-1.5 (sd8686) with v4.7-rc3.
Confirmed that lbs_mac_event_disconnected is being called on the
station when hostapd
a real bug? Is it enough to add mutex_lock to wcn36xx_set_tx_data?
--
Pavel Andrianov
Linux Verification Center, ISPRAS
web: http://linuxtesting.org
e-mail: andria...@ispras.ru
08.06.2016 02:51, James Cameron пишет:
On Tue, Jun 07, 2016 at 09:39:55AM -0500, Dan Williams wrote:
On Tue, 2016-06-07 at 13:30 +0400, Pavel Andrianov wrote:
Hi!
There is a potential race condition in
drivers/net/wireless/libertas/libertas.ko.
In the function lbs_hard_start_xmit(..), line
affect the rtl88e_dm_watchdog as in
the previous case.
--
Pavel Andrianov
Linux Verification Center, ISPRAS
web: http://linuxtesting.org
e-mail: andria...@ispras.ru
07.06.2016 18:39, Dan Williams пишет:
On Tue, 2016-06-07 at 13:30 +0400, Pavel Andrianov wrote:
Hi!
There is a potential race condition in
drivers/net/wireless/libertas/libertas.ko.
In the function lbs_hard_start_xmit(..), line 159, a socket buffer
is
written to priv->current_
mit.
Is it a real race or I have missed something?
--
Pavel Andrianov
Linux Verification Center, ISPRAS
web: http://linuxtesting.org
e-mail: andria...@ispras.ru
13 matches
Mail list logo
