linux-kernel - [PATCH resend] rt5208: Fix a sleep-in-atomic bug in xd_copy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1496625995-27776-1-git-send-email-baijiaju1990@163.com>
Date:   Mon,  5 Jun 2017 09:26:35 +0800
From:   Jia-Ju Bai <baijiaju1990@....com>
To:     gregkh@...uxfoundation.org, wporter82@...il.com,
        sergio.paracuellos@...il.com, aquannie@...il.com
Cc:     devel@...verdev.osuosl.org, linux-kernel@...r.kernel.org,
        Jia-Ju Bai <baijiaju1990@....com>
Subject: [PATCH resend] rt5208: Fix a sleep-in-atomic bug in xd_copy_page

Last patch lacks code explanation, and it is included in this patch.

The driver may sleep under a spin lock, and the function call path is:
rtsx_exclusive_enter_ss (acquire the lock by spin_lock)
  rtsx_enter_ss
    rtsx_power_off_card
      xd_cleanup_work
        xd_delay_write
          xd_finish_write
            xd_copy_page
              wait_timeout
                schedule_timeout --> may sleep

To fix it, "wait_timeout" is replaced with mdelay in xd_copy_page.

Signed-off-by: Jia-Ju Bai <baijiaju1990@....com>
---
 drivers/staging/rts5208/xd.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/rts5208/xd.c b/drivers/staging/rts5208/xd.c
index 85aba05..74d36f9 100644
--- a/drivers/staging/rts5208/xd.c
+++ b/drivers/staging/rts5208/xd.c
@@ -1268,7 +1268,7 @@ static int xd_copy_page(struct rtsx_chip *chip, u32 old_blk, u32 new_blk,
 			reg = 0;
 			rtsx_read_register(chip, XD_CTL, &reg);
 			if (reg & (XD_ECC1_ERROR | XD_ECC2_ERROR)) {
-				wait_timeout(100);
+				mdelay(100);
 
 				if (detect_card_cd(chip,
 						   XD_CARD) != STATUS_SUCCESS) {
-- 
1.7.9.5