diff options
| author | Jia-Ju Bai <baijiaju1990@gmail.com> | 2018-09-01 17:23:47 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-09-26 08:39:32 +0200 |
| commit | c6346e3fbb183205fd803d9045416ff022641ba2 (patch) | |
| tree | 30219a1fadf116e60002a8178b1bafc9c7603c8e /drivers/usb | |
| parent | 066bfee7ec757874b3229af8d9dd3204471e393f (diff) | |
| download | linux-stable-c6346e3fbb183205fd803d9045416ff022641ba2.tar.gz linux-stable-c6346e3fbb183205fd803d9045416ff022641ba2.tar.bz2 linux-stable-c6346e3fbb183205fd803d9045416ff022641ba2.zip | |
usb: host: u132-hcd: Fix a sleep-in-atomic-context bug in u132_get_frame()
commit 6d4f268fa132742fe96dad22307c68d237356d88 upstream.
i_usX2Y_subs_startup in usbusx2yaudio.c is a completion handler function
for the USB driver. So it should not sleep, but it is can sleep
according to the function call paths (from bottom to top) in Linux-4.16.
[FUNC] msleep
drivers/usb/host/u132-hcd.c, 2558:
msleep in u132_get_frame
drivers/usb/core/hcd.c, 2231:
[FUNC_PTR]u132_get_frame in usb_hcd_get_frame_number
drivers/usb/core/usb.c, 822:
usb_hcd_get_frame_number in usb_get_current_frame_number
sound/usb/usx2y/usbusx2yaudio.c, 303:
usb_get_current_frame_number in i_usX2Y_urb_complete
sound/usb/usx2y/usbusx2yaudio.c, 366:
i_usX2Y_urb_complete in i_usX2Y_subs_startup
Note that [FUNC_PTR] means a function pointer call is used.
To fix this bug, msleep() is replaced with mdelay().
This bug is found by my static analysis tool DSAC.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb')
| -rw-r--r-- | drivers/usb/host/u132-hcd.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/usb/host/u132-hcd.c b/drivers/usb/host/u132-hcd.c index 032b8652910a..02f8e08b3ee8 100644 --- a/drivers/usb/host/u132-hcd.c +++ b/drivers/usb/host/u132-hcd.c @@ -2555,7 +2555,7 @@ static int u132_get_frame(struct usb_hcd *hcd) } else { int frame = 0; dev_err(&u132->platform_dev->dev, "TODO: u132_get_frame\n"); - msleep(100); + mdelay(100); return frame; } } |