Commit a4dd4fc6 authored May 24, 2021 by Saubhik Mukherjee Committed by David S. Miller May 24, 2021

net: appletalk: cops: Fix data race in cops_probe1

In cops_probe1(), there is a write to dev->base_addr after requesting an
interrupt line and registering the interrupt handler cops_interrupt().
The handler might be called in parallel to handle an interrupt.
cops_interrupt() tries to read dev->base_addr leading to a potential
data race. So write to dev->base_addr before calling request_irq().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Saubhik Mukherjee <saubhik.mukherjee@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 93c5d741

drivers/net/appletalk/cops.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -327,6 +327,8 @@ static int __init cops_probe1(struct net_device *dev, int ioaddr)
		break;
		}

		dev->base_addr = ioaddr;

		/* Reserve any actual interrupt. */
		if (dev->irq) {
		retval = request_irq(dev->irq, cops_interrupt, 0, dev->name, dev);
		@@ -334,8 +336,6 @@ static int __init cops_probe1(struct net_device *dev, int ioaddr)
		goto err_out;
		}

		dev->base_addr = ioaddr;

		lp = netdev_priv(dev);
		spin_lock_init(&lp->lock);