[BUG] znet.c sleeping function called from invalid context

[BUG] znet.c sleeping function called from invalid context

[Alexander Strakh]

	KERNEL_VERSION: 2.6.31
	DESCRIBE:
Driver drivers/net/znet.c might sleep in atomic context, because it calls 
free_dma under claim_dma_lock:

.drivers/net/znet.c:
 168 static int znet_request_resources (struct net_device *dev)
...
 189        flags = claim_dma_lock();
 190        free_dma (znet->tx_dma);
 191        release_dma_lock (flags);
...

Path to might_sleep macro from znet_request_resources:
1. znet_request_resources calls free_dma at 
arch/blackfin/kernel/bfin_dma_5xx.c:181
2. free_dma calls arch/blackfin/kernel/bfin_dma_5xx.c:195

Found by: Linux Driver Verification

Re: [BUG] znet.c sleeping function called from invalid context

[Mike Frysinger]

On Wed, Oct 7, 2009 at 14:47, Alexander Strakh wrote:
>        KERNEL_VERSION: 2.6.31
>        DESCRIBE:
> Driver drivers/net/znet.c might sleep in atomic context, because it calls
> free_dma under claim_dma_lock:
>
> .drivers/net/znet.c:
>  168 static int znet_request_resources (struct net_device *dev)
> ...
>  189        flags = claim_dma_lock();
>  190        free_dma (znet->tx_dma);
>  191        release_dma_lock (flags);
> ...
>
> Path to might_sleep macro from znet_request_resources:
> 1. znet_request_resources calls free_dma at
> arch/blackfin/kernel/bfin_dma_5xx.c:181
> 2. free_dma calls arch/blackfin/kernel/bfin_dma_5xx.c:195

i dont think we need the dmalock mutex.  it's only used to protect
read/writes to .chan_status, and that should be atomic already.
-mike
_______________________________________________
Uclinux-dist-devel mailing list
Uclinux-dist-devel@blackfin.uclinux.org
https://blackfin.uclinux.org/mailman/listinfo/uclinux-dist-devel

Re: [BUG] znet.c sleeping function called from invalid context

[David Miller]

From: Mike Frysinger <vapier.adi-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
Date: Wed, 7 Oct 2009 14:44:45 -0400

> On Wed, Oct 7, 2009 at 14:47, Alexander Strakh wrote:
>>        KERNEL_VERSION: 2.6.31
>>        DESCRIBE:
>> Driver drivers/net/znet.c might sleep in atomic context, because it calls
>> free_dma under claim_dma_lock:
>>
>> .drivers/net/znet.c:
>>  168 static int znet_request_resources (struct net_device *dev)
>> ...
>>  189        flags = claim_dma_lock();
>>  190        free_dma (znet->tx_dma);
>>  191        release_dma_lock (flags);
>> ...
>>
>> Path to might_sleep macro from znet_request_resources:
>> 1. znet_request_resources calls free_dma at
>> arch/blackfin/kernel/bfin_dma_5xx.c:181
>> 2. free_dma calls arch/blackfin/kernel/bfin_dma_5xx.c:195
> 
> i dont think we need the dmalock mutex.  it's only used to protect
> read/writes to .chan_status, and that should be atomic already.
> -mike

I'm checking in the obvious fix to net-2.6, thanks for the report:

znet: Don't claim DMA lock around free_dma() calls.

It's not necessary and it's illegal too.

Reported-by: Alexander Strakh <strakh-ufN2psIa012HXe+LvDLADg@public.gmane.org>
Signed-off-by: David S. Miller <davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>
---
 drivers/net/znet.c |    8 --------
 1 files changed, 0 insertions(+), 8 deletions(-)

diff --git a/drivers/net/znet.c b/drivers/net/znet.c
index a0384b6..b423473 100644
--- a/drivers/net/znet.c
+++ b/drivers/net/znet.c
@@ -169,7 +169,6 @@ static void znet_tx_timeout (struct net_device *dev);
 static int znet_request_resources (struct net_device *dev)
 {
 	struct znet_private *znet = netdev_priv(dev);
-	unsigned long flags;
 
 	if (request_irq (dev->irq, &znet_interrupt, 0, "ZNet", dev))
 		goto failed;
@@ -187,13 +186,9 @@ static int znet_request_resources (struct net_device *dev)
  free_sia:
 	release_region (znet->sia_base, znet->sia_size);
  free_tx_dma:
-	flags = claim_dma_lock();
 	free_dma (znet->tx_dma);
-	release_dma_lock (flags);
  free_rx_dma:
-	flags = claim_dma_lock();
 	free_dma (znet->rx_dma);
-	release_dma_lock (flags);
  free_irq:
 	free_irq (dev->irq, dev);
  failed:
@@ -203,14 +198,11 @@ static int znet_request_resources (struct net_device *dev)
 static void znet_release_resources (struct net_device *dev)
 {
 	struct znet_private *znet = netdev_priv(dev);
-	unsigned long flags;
 
 	release_region (znet->sia_base, znet->sia_size);
 	release_region (dev->base_addr, znet->io_size);
-	flags = claim_dma_lock();
 	free_dma (znet->tx_dma);
 	free_dma (znet->rx_dma);
-	release_dma_lock (flags);
 	free_irq (dev->irq, dev);
 }
 
-- 
1.6.4.4