Re: [PATCH] ath9k: fix possible sleep-in-atomic-context bugs in hif_usb_send_regout()
From: Kalle Valo <hidden>
Date: 2019-12-18 12:02:28
Also in:
linux-wireless, lkml
Jia-Ju Bai [off-list ref] writes:
The driver may sleep while holding a spinlock. The function call path (from bottom to top) in Linux 4.19 is: drivers/net/wireless/ath/ath9k/hif_usb.c, 108: usb_alloc_urb(GFP_KERNEL) in hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c, 470: hif_usb_send_regout in hif_usb_send drivers/net/wireless/ath/ath9k/htc_hst.c, 34: (FUNC_PTR)hif_usb_send in htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c, 295: htc_issue_send in htc_send drivers/net/wireless/ath/ath9k/htc_drv_beacon.c, 250: htc_send in ath9k_htc_send_beacon drivers/net/wireless/ath/ath9k/htc_drv_beacon.c, 207: spin_lock_bh in ath9k_htc_send_beacon drivers/net/wireless/ath/ath9k/hif_usb.c, 112: kzalloc(GFP_KERNEL) in hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c, 470: hif_usb_send_regout in hif_usb_send drivers/net/wireless/ath/ath9k/htc_hst.c, 34: (FUNC_PTR)hif_usb_send in htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c, 295: htc_issue_send in htc_send drivers/net/wireless/ath/ath9k/htc_drv_beacon.c, 250: htc_send in ath9k_htc_send_beacon drivers/net/wireless/ath/ath9k/htc_drv_beacon.c, 207: spin_lock_bh in ath9k_htc_send_beacon drivers/net/wireless/ath/ath9k/hif_usb.c, 127: usb_submit_urb(GFP_KERNEL) in hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c, 470: hif_usb_send_regout in hif_usb_send drivers/net/wireless/ath/ath9k/htc_hst.c, 34: (FUNC_PTR)hif_usb_send in htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c, 295: htc_issue_send in htc_send drivers/net/wireless/ath/ath9k/htc_drv_beacon.c, 250: htc_send in ath9k_htc_send_beacon drivers/net/wireless/ath/ath9k/htc_drv_beacon.c, 207: spin_lock_bh in ath9k_htc_send_beacon (FUNC_PTR) means a function pointer is called. To fix these bugs, GFP_KERNEL is replaced with GFP_ATOMIC. These bugs are found by a static analysis tool STCheck written by myself. Signed-off-by: Jia-Ju Bai <redacted>
Can someone else verify this and provide Reviewed-by? -- https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches