lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <1513084086-28056-1-git-send-email-baijiaju1990@gmail.com> Date: Tue, 12 Dec 2017 21:08:06 +0800 From: Jia-Ju Bai <baijiaju1990@...il.com> To: gregkh@...uxfoundation.org, aishpant@...il.com, insafonov@...il.com, luca@...aceresoli.net, goudapatilk@...il.com, armetallica@...il.com, keescook@...omium.org, mihaela.muraru21@...il.com Cc: devel@...verdev.osuosl.org, linux-kernel@...r.kernel.org, Jia-Ju Bai <baijiaju1990@...il.com> Subject: [PATCH] rtl8188eu: Fix a possible sleep-in-atomic bug in set_tx_beacon_cmd The driver may sleep under a spinlock. The function call path is: update_beacon (acquire the spinlock) update_BCNTIM set_tx_beacon_cmd kzalloc(GFP_KERNEL) --> may sleep kmemdup(GFP_KERNEL) --> may sleep To fix it, GFP_KERNEL is replaced with GFP_ATOMIC. This bug is found by my static analysis tool(DSAC) and checked by my code review. Signed-off-by: Jia-Ju Bai <baijiaju1990@...il.com> --- drivers/staging/rtl8188eu/core/rtw_mlme_ext.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c b/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c index d73e9bd..bcb6919 100644 --- a/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c +++ b/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c @@ -5395,14 +5395,14 @@ u8 set_tx_beacon_cmd(struct adapter *padapter) int len_diff = 0; - ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL); + ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC); if (!ph2c) { res = _FAIL; goto exit; } ptxBeacon_parm = kmemdup(&(pmlmeinfo->network), - sizeof(struct wlan_bssid_ex), GFP_KERNEL); + sizeof(struct wlan_bssid_ex), GFP_ATOMIC); if (ptxBeacon_parm == NULL) { kfree(ph2c); res = _FAIL; -- 1.7.9.5
Powered by blists - more mailing lists