summaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorJia-Ju Bai <baijiaju1990@gmail.com>2018-06-20 11:55:08 +0800
committerFelipe Balbi <felipe.balbi@linux.intel.com>2018-07-17 10:12:51 +0300
commitf36b507c14c4b6e634463a610294e9cb0065c8ea (patch)
treeeae28b7d25ab25066aa0aec6436d554aa7347fc9 /drivers
parent0602088b10a7c0b4e044a810678ef93d7cc5bf48 (diff)
downloadlinux-stable-f36b507c14c4b6e634463a610294e9cb0065c8ea.tar.gz
linux-stable-f36b507c14c4b6e634463a610294e9cb0065c8ea.tar.bz2
linux-stable-f36b507c14c4b6e634463a610294e9cb0065c8ea.zip
usb: gadget: r8a66597: Fix a possible sleep-in-atomic-context bugs in r8a66597_queue()
The driver may sleep in an interrupt handler. The function call path (from bottom to top) in Linux-4.16.7 is: [FUNC] r8a66597_queue(GFP_KERNEL) drivers/usb/gadget/udc/r8a66597-udc.c, 1193: r8a66597_queue in get_status drivers/usb/gadget/udc/r8a66597-udc.c, 1301: get_status in setup_packet drivers/usb/gadget/udc/r8a66597-udc.c, 1381: setup_packet in irq_control_stage drivers/usb/gadget/udc/r8a66597-udc.c, 1508: irq_control_stage in r8a66597_irq (interrupt handler) To fix this bug, GFP_KERNEL is replaced with GFP_ATOMIC. This bug is found by my static analysis tool (DSAC-2) and checked by my code review. Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/usb/gadget/udc/r8a66597-udc.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c
index 24ee9867964b..11e25a3f4f1f 100644
--- a/drivers/usb/gadget/udc/r8a66597-udc.c
+++ b/drivers/usb/gadget/udc/r8a66597-udc.c
@@ -1190,7 +1190,7 @@ __acquires(r8a66597->lock)
r8a66597->ep0_req->length = 2;
/* AV: what happens if we get called again before that gets through? */
spin_unlock(&r8a66597->lock);
- r8a66597_queue(r8a66597->gadget.ep0, r8a66597->ep0_req, GFP_KERNEL);
+ r8a66597_queue(r8a66597->gadget.ep0, r8a66597->ep0_req, GFP_ATOMIC);
spin_lock(&r8a66597->lock);
}