netdev - Re: [BUG] znet.c sleeping function called from invalid context

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 07 Oct 2009 22:15:55 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	vapier.adi@...il.com
Cc:	michael.hennerich@...log.com, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org, strakh@...ras.ru,
	uclinux-dist-devel@...ckfin.uclinux.org
Subject: Re: [BUG] znet.c sleeping function called from invalid context

From: Mike Frysinger <vapier.adi@...il.com>
Date: Wed, 7 Oct 2009 14:44:45 -0400

> On Wed, Oct 7, 2009 at 14:47, Alexander Strakh wrote:
>>        KERNEL_VERSION: 2.6.31
>>        DESCRIBE:
>> Driver drivers/net/znet.c might sleep in atomic context, because it calls
>> free_dma under claim_dma_lock:
>>
>> .drivers/net/znet.c:
>>  168 static int znet_request_resources (struct net_device *dev)
>> ...
>>  189        flags = claim_dma_lock();
>>  190        free_dma (znet->tx_dma);
>>  191        release_dma_lock (flags);
>> ...
>>
>> Path to might_sleep macro from znet_request_resources:
>> 1. znet_request_resources calls free_dma at
>> arch/blackfin/kernel/bfin_dma_5xx.c:181
>> 2. free_dma calls arch/blackfin/kernel/bfin_dma_5xx.c:195
> 
> i dont think we need the dmalock mutex.  it's only used to protect
> read/writes to .chan_status, and that should be atomic already.
> -mike

I'm checking in the obvious fix to net-2.6, thanks for the report:

znet: Don't claim DMA lock around free_dma() calls.

It's not necessary and it's illegal too.

Reported-by: Alexander Strakh <strakh@...ras.ru>
Signed-off-by: David S. Miller <davem@...emloft.net>
---
 drivers/net/znet.c |    8 --------
 1 files changed, 0 insertions(+), 8 deletions(-)

diff --git a/drivers/net/znet.c b/drivers/net/znet.c
index a0384b6..b423473 100644
--- a/drivers/net/znet.c
+++ b/drivers/net/znet.c
@@ -169,7 +169,6 @@ static void znet_tx_timeout (struct net_device *dev);
 static int znet_request_resources (struct net_device *dev)
 {
 	struct znet_private *znet = netdev_priv(dev);
-	unsigned long flags;
 
 	if (request_irq (dev->irq, &znet_interrupt, 0, "ZNet", dev))
 		goto failed;
@@ -187,13 +186,9 @@ static int znet_request_resources (struct net_device *dev)
  free_sia:
 	release_region (znet->sia_base, znet->sia_size);
  free_tx_dma:
-	flags = claim_dma_lock();
 	free_dma (znet->tx_dma);
-	release_dma_lock (flags);
  free_rx_dma:
-	flags = claim_dma_lock();
 	free_dma (znet->rx_dma);
-	release_dma_lock (flags);
  free_irq:
 	free_irq (dev->irq, dev);
  failed:
@@ -203,14 +198,11 @@ static int znet_request_resources (struct net_device *dev)
 static void znet_release_resources (struct net_device *dev)
 {
 	struct znet_private *znet = netdev_priv(dev);
-	unsigned long flags;
 
 	release_region (znet->sia_base, znet->sia_size);
 	release_region (dev->base_addr, znet->io_size);
-	flags = claim_dma_lock();
 	free_dma (znet->tx_dma);
 	free_dma (znet->rx_dma);
-	release_dma_lock (flags);
 	free_irq (dev->irq, dev);
 }
 
-- 
1.6.4.4

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html