diff options
| author | Jia-Ju Bai <baijiaju1990@gmail.com> | 2018-09-15 10:57:11 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-09-18 13:25:01 +0200 |
| commit | 2051c6ae928ddbd4d314ba8ea89298d686ad86b7 (patch) | |
| tree | 7ee0b995b8ff57e256989e46f2155f5bd8ca631b | |
| parent | 7af5bd0ca431dc0a3fcdd9ab18bab135a15a9a1c (diff) | |
| download | linux-stable-2051c6ae928ddbd4d314ba8ea89298d686ad86b7.tar.gz linux-stable-2051c6ae928ddbd4d314ba8ea89298d686ad86b7.tar.bz2 linux-stable-2051c6ae928ddbd4d314ba8ea89298d686ad86b7.zip | |
staging: rtl8188eu: Fix a sleep-in-atomic-context bug in issue_deauth_ex()
The driver may sleep with holding a spinlock.
The function call path (from bottom to top) in Linux-4.17 is:
[FUNC] msleep
drivers/staging/rtl8188eu/core/rtw_mlme_ext.c, 1536:
msleep in issue_deauth_ex
drivers/staging/rtl8188eu/core/rtw_mlme_ext.c, 5110:
issue_deauth_ex in disconnect_hdl
drivers/staging/rtl8188eu/core/rtw_cmd.c, 521:
disconnect_hdl in rtw_disassoc_cmd
drivers/staging/rtl8188eu/core/rtw_ioctl_set.c, 352:
rtw_disassoc_cmd in rtw_set_802_11_infrastructure_mode
drivers/staging/rtl8188eu/os_dep/ioctl_linux.c, 1002:
rtw_set_802_11_infrastructure_mode in rtw_wx_set_wap
drivers/staging/rtl8188eu/os_dep/ioctl_linux.c, 988:
spin_lock_bh in rtw_wx_set_wap
To fix this bug, msleep() is replaced with mdelay().
This bug is found by my static analysis tool DSAC.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/staging/rtl8188eu/core/rtw_mlme_ext.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c b/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c index 213c8d670591..834053a0ae9d 100644 --- a/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c +++ b/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c @@ -1513,7 +1513,7 @@ static int issue_deauth_ex(struct adapter *padapter, u8 *da, break; if (i < try_cnt && wait_ms > 0 && ret == _FAIL) - msleep(wait_ms); + mdelay(wait_ms); } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0))); if (ret != _FAIL) { |