Skip to content

Commit f36b507

Browse files
XidianGeneralFelipe Balbi
authored andcommitted
usb: gadget: r8a66597: Fix a possible sleep-in-atomic-context bugs in r8a66597_queue()
The driver may sleep in an interrupt handler. The function call path (from bottom to top) in Linux-4.16.7 is: [FUNC] r8a66597_queue(GFP_KERNEL) drivers/usb/gadget/udc/r8a66597-udc.c, 1193: r8a66597_queue in get_status drivers/usb/gadget/udc/r8a66597-udc.c, 1301: get_status in setup_packet drivers/usb/gadget/udc/r8a66597-udc.c, 1381: setup_packet in irq_control_stage drivers/usb/gadget/udc/r8a66597-udc.c, 1508: irq_control_stage in r8a66597_irq (interrupt handler) To fix this bug, GFP_KERNEL is replaced with GFP_ATOMIC. This bug is found by my static analysis tool (DSAC-2) and checked by my code review. Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
1 parent 0602088 commit f36b507

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

drivers/usb/gadget/udc/r8a66597-udc.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1190,7 +1190,7 @@ __acquires(r8a66597->lock)
11901190
r8a66597->ep0_req->length = 2;
11911191
/* AV: what happens if we get called again before that gets through? */
11921192
spin_unlock(&r8a66597->lock);
1193-
r8a66597_queue(r8a66597->gadget.ep0, r8a66597->ep0_req, GFP_KERNEL);
1193+
r8a66597_queue(r8a66597->gadget.ep0, r8a66597->ep0_req, GFP_ATOMIC);
11941194
spin_lock(&r8a66597->lock);
11951195
}
11961196

0 commit comments

Comments
 (0)