linux-kernel - [PATCH] pci: Fix a possible sleep-in-atomic bug in pci_set_power

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1507536980-9345-1-git-send-email-baijiaju1990@163.com>
Date:   Mon,  9 Oct 2017 16:16:20 +0800
From:   Jia-Ju Bai <baijiaju1990@....com>
To:     patrik.r.jakobsson@...il.com, airlied@...ux.ie,
        bhelgaas@...gle.com, forest@...ttletooquiet.net,
        gregkh@...uxfoundation.org, simon@...anor.nu, scott@...heina.com,
        tvboxspy@...il.com, dan.a.cashman@...il.com,
        golubev.mikhail@...il.com
Cc:     devel@...verdev.osuosl.org, linux-pci@...r.kernel.org,
        linux-kernel@...r.kernel.org, dri-devel@...ts.freedesktop.org,
        Jia-Ju Bai <baijiaju1990@....com>
Subject: [PATCH] pci: Fix a possible sleep-in-atomic bug in pci_set_power_state

The drivers vt6655 and gma500 call pci_set_power_state under a spinlock, which may sleep.
The function call paths are:
gma_power_begin (acquire the spinlock) (drivers/gpu/drm/gma500/power.c)
  gma_resume_pci
    pci_set_power_state
      __pci_start_power_transition (drivers/pci/pci.c)
        msleep --> may sleep

gma_power_begin (acquire the spinlock) (drivers/gpu/drm/gma500/power.c)
  gma_resume_pci
    pci_enable_device
      pci_enable_device_flags (drivers/pci/pci.c)
        do_pci_enable_device
          pci_set_power_state
            __pci_start_power_transition
              msleep --> may sleep

vt6655_suspend (acquire the spinlock) (drivers/staging/vt6655/device_main.c)
  pci_set_power_state
    __pci_start_power_transition (drivers/pci/pci.c)
      msleep --> may sleep

To fix these bugs, msleep is replaced with mdelay in __pci_start_power_transition

These bugs are found by my static analysis tool and my code review.

Signed-off-by: Jia-Ju Bai <baijiaju1990@....com>
---
 drivers/pci/pci.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 6078dfc..7b763a3 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -823,7 +823,7 @@ static void __pci_start_power_transition(struct pci_dev *dev, pci_power_t state)
 		 */
 		if (dev->runtime_d3cold) {
 			if (dev->d3cold_delay)
-				msleep(dev->d3cold_delay);
+				mdelay(dev->d3cold_delay);
 			/*
 			 * When powering on a bridge from D3cold, the
 			 * whole hierarchy may be powered on into
-- 
1.7.9.5