Potential double-lock BUG in drivers/tty/serial/sh-sci.c (Linux 4.9)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

With the help of a static bug finder (EBA -
https://github.com/models-team/eba) I have found a potential
double-lock in drivers/tty/serial/sh-sci.c. This happens due to a
recursive spin_lock_irqsave on `port->lock'.

If this is indeed a bug, I will be happy to help with a patch.

The trace is as follows:

1. Function `rx_timer_fn' takes the lock first in line 1361:

    // see https://github.com/torvalds/linux/blob/v4.9-rc6/drivers/tty/serial/sh-sci.c#L1361
    spin_lock_irqsave(&port->lock, flags);

2. Call to `sci_submit_rx' in line 1409;
3. Enter loop in line 1260;
4. `goto fail' in line 1268;
5. Call to `sci_rx_dma_release' in line 1292;
6. The lock is taken a second time in line 1175:

    // see https://github.com/torvalds/linux/blob/v4.9-rc6/drivers/tty/serial/sh-sci.c#L1175
    spin_lock_irqsave(&port->lock, flags);

Hope it helps!

--
iago
--
To unsubscribe from this list: send the line "unsubscribe linux-serial" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Linux PPP]     [Linux FS]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Video 4 Linux]     [Linmodem]     [Device Mapper]     [Linux Kernel for ARM]

  Powered by Linux