From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>,
Felipe Balbi <felipe.balbi@linux.intel.com>,
Sasha Levin <sashal@kernel.org>,
linux-usb@vger.kernel.org
Subject: [PATCH AUTOSEL 4.4 07/48] usb: gadget: udc: fotg210-udc: Fix a sleep-in-atomic-context bug in fotg210_get_status()
Date: Tue, 12 Nov 2019 21:00:50 -0500 [thread overview]
Message-ID: <20191113020131.13356-7-sashal@kernel.org> (raw)
In-Reply-To: <20191113020131.13356-1-sashal@kernel.org>
From: Jia-Ju Bai <baijiaju1990@gmail.com>
[ Upstream commit 2337a77c1cc86bc4e504ecf3799f947659c86026 ]
The driver may sleep in an interrupt handler.
The function call path (from bottom to top) in Linux-4.17 is:
[FUNC] fotg210_ep_queue(GFP_KERNEL)
drivers/usb/gadget/udc/fotg210-udc.c, 744:
fotg210_ep_queue in fotg210_get_status
drivers/usb/gadget/udc/fotg210-udc.c, 768:
fotg210_get_status in fotg210_setup_packet
drivers/usb/gadget/udc/fotg210-udc.c, 949:
fotg210_setup_packet in fotg210_irq (interrupt handler)
To fix this bug, GFP_KERNEL is replaced with GFP_ATOMIC.
If possible, spin_unlock() and spin_lock() around fotg210_ep_queue()
can be also removed.
This bug is found by my static analysis tool DSAC.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/udc/fotg210-udc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
index 95df2b3bb6a1a..76e991557116a 100644
--- a/drivers/usb/gadget/udc/fotg210-udc.c
+++ b/drivers/usb/gadget/udc/fotg210-udc.c
@@ -744,7 +744,7 @@ static void fotg210_get_status(struct fotg210_udc *fotg210,
fotg210->ep0_req->length = 2;
spin_unlock(&fotg210->lock);
- fotg210_ep_queue(fotg210->gadget.ep0, fotg210->ep0_req, GFP_KERNEL);
+ fotg210_ep_queue(fotg210->gadget.ep0, fotg210->ep0_req, GFP_ATOMIC);
spin_lock(&fotg210->lock);
}
--
2.20.1
next prev parent reply other threads:[~2019-11-13 2:05 UTC|newest]
Thread overview: 48+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-13 2:00 [PATCH AUTOSEL 4.4 01/48] net: ovs: fix return type of ndo_start_xmit function Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 02/48] ARM: dts: omap5: enable OTG role for DWC3 controller Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 03/48] f2fs: return correct errno in f2fs_gc Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 04/48] SUNRPC: Fix priority queue fairness Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 05/48] ath10k: fix vdev-start timeout on error Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 06/48] ath9k: fix reporting calculated new FFT upper max Sasha Levin
2019-11-13 2:00 ` Sasha Levin [this message]
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 08/48] nl80211: Fix a GET_KEY reply attribute Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 09/48] dmaengine: ep93xx: Return proper enum in ep93xx_dma_chan_direction Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 10/48] dmaengine: timb_dma: Use proper enum in td_prep_slave_sg Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 11/48] mei: samples: fix a signedness bug in amt_host_if_call() Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 12/48] cxgb4: Use proper enum in cxgb4_dcb_handle_fw_update Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 13/48] cxgb4: Use proper enum in IEEE_FAUX_SYNC Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 14/48] powerpc/pseries: Fix DTL buffer registration Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 15/48] powerpc/pseries: Fix how we iterate over the DTL entries Sasha Levin
2019-11-13 2:00 ` [PATCH AUTOSEL 4.4 16/48] mtd: rawnand: sh_flctl: Use proper enum for flctl_dma_fifo0_transfer Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 17/48] ixgbe: Fix crash with VFs and flow director on interface flap Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 18/48] IB/mthca: Fix error return code in __mthca_init_one() Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 19/48] ata: ep93xx: Use proper enums for directions Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 20/48] ALSA: hda/sigmatel - Disable automute for Elo VuPoint Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 21/48] KVM: PPC: Book3S PR: Exiting split hack mode needs to fixup both PC and LR Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 22/48] USB: serial: cypress_m8: fix interrupt-out transfer length Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 23/48] mtd: physmap_of: Release resources on error Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 24/48] brcmfmac: fix full timeout waiting for action frame on-channel tx Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 25/48] NFSv4.x: fix lock recovery during delegation recall Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 26/48] dmaengine: ioat: fix prototype of ioat_enumerate_channels Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 27/48] Input: st1232 - set INPUT_PROP_DIRECT property Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 28/48] x86/olpc: Fix build error with CONFIG_MFD_CS5535=m Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 29/48] crypto: mxs-dcp - Fix SHA null hashes and output length Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 30/48] crypto: mxs-dcp - Fix AES issues Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 31/48] ACPI / SBS: Fix rare oops when removing modules Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 32/48] fbdev: sbuslib: use checked version of put_user() Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 33/48] fbdev: sbuslib: integer overflow in sbusfb_ioctl_helper() Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 34/48] bcache: recal cached_dev_sectors on detach Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 35/48] proc/vmcore: Fix i386 build error of missing copy_oldmem_page_encrypted() Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 36/48] backlight: lm3639: Unconditionally call led_classdev_unregister Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 37/48] printk: Give error on attempt to set log buffer length to over 2G Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 38/48] media: isif: fix a NULL pointer dereference bug Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 39/48] GFS2: Flush the GFS2 delete workqueue before stopping the kernel threads Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 40/48] media: cx231xx: fix potential sign-extension overflow on large shift Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 41/48] x86/kexec: Correct KEXEC_BACKUP_SRC_END off-by-one error Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 42/48] gpio: syscon: Fix possible NULL ptr usage Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 43/48] spi: spidev: Fix OF tree warning logic Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 44/48] ARM: 8802/1: Call syscall_trace_exit even when system call skipped Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 45/48] hwmon: (pwm-fan) Silence error on probe deferral Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 46/48] mac80211: minstrel: fix CCK rate group streams value Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 47/48] spi: rockchip: initialize dma_slave_config properly Sasha Levin
2019-11-13 2:01 ` [PATCH AUTOSEL 4.4 48/48] ARM: dts: omap5: Fix dual-role mode on Super-Speed port Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191113020131.13356-7-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=baijiaju1990@gmail.com \
--cc=felipe.balbi@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox