Re: [PATCH RFC] usb: adutux: fix unlocked read_buffer_length write in adu_open() (data race)

[Oliver Neukum]

On 13.07.26 06:45, Kanishka De Silva wrote:

> I reproduced the race by extracting the exact code paths (locking
> primitives, field layout, and control flow) into a standalone
> userspace program and running it under ThreadSanitizer with pthreads
> simulating the IRQ callback and open() paths concurrently. TSan

Hi,

thank you for this elaborate testing.
However, are you sure of your simulation?

That is, can the circumstances you are simulating really arise?
adu_interrupt_in_callback() cannot really run after adu_release_internal()
as that calls adu_abort_transfers(), which in turn uses usb_kill_urb()
on interrupt_in_urb.

As the driver implements an exclusive open policy and uses a mutex
to guard that, it seems to me that adu_open() can race only against
itself and adu_release, both taking a mutex precisely to prevent
that.

	Regards
		Oliver