[BUG] net: huawei: hinic: a possible sleep-in-atomic-context bug in msg_to_mgmt_async
From: Jia-Ju Bai <hidden>
Date: 2019-01-11 02:32:38
Also in:
lkml
From: Jia-Ju Bai <hidden>
Date: 2019-01-11 02:32:38
Also in:
lkml
The driver may sleep in an interrupt handler. The function call path (from bottom to top) in the directory "drivers/net/ethernet/huawei/hinic/" in Linux-4.17 is: [FUNC] down hinic_hw_mgmt.c, 324: down in msg_to_mgmt_async hinic_hw_mgmt.c, 408: msg_to_mgmt_async in mgmt_recv_msg_handler hinic_hw_mgmt.c, 464:mgmt_recv_msg_handler in recv_mgmt_msg_handler hinic_hw_mgmt.c, 484: recv_mgmt_msg_handler in mgmt_msg_aeqe_handler hinic_hw_eqs.c, 264: [FUNC_PTR]mgmt_msg_aeqe_handler in aeq_irq_handler hinic_hw_eqs.c, 355: aeq_irq_handler in eq_irq_handler hinic_hw_eqs.c, 383: eq_irq_handler in ceq_tasklet Note that [FUNC_PTR] means a function pointer call. This bug is found by my static analysis tool (DSAC-2) and checked by my manual code review. I do not know how to correctly fix this bug, so I just report it. A possible way may be to replace up() and down() with spin_lock() and spin_unlock(). Best wishes, Jia-Ju Bai