linux-kernel - [PATCH] staging: rtl8192u: Fix sleep in atomic context bug in dm_fsync_timer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 20 May 2022 14:15:41 +0800
From:   Duoming Zhou <duoming@....edu.cn>
To:     linux-staging@...ts.linux.dev, gregkh@...uxfoundation.org
Cc:     davem@...emloft.net, kuba@...nel.org, alexander.deucher@....com,
        broonie@...nel.org, linux-kernel@...r.kernel.org,
        Duoming Zhou <duoming@....edu.cn>
Subject: [PATCH] staging: rtl8192u: Fix sleep in atomic context bug in dm_fsync_timer_callback

There are sleep in atomic context bugs when dm_fsync_timer_callback is
executing. The root cause is that the memory allocation functions with
GFP_KERNEL parameter are called in dm_fsync_timer_callback which is a
timer handler. The call paths that could trigger bugs are shown below:

    (interrupt context)
dm_fsync_timer_callback
  write_nic_byte
    kzalloc(sizeof(data), GFP_KERNEL); //may sleep
  write_nic_dword
    kzalloc(sizeof(data), GFP_KERNEL); //may sleep

This patch changes allocation mode from GFP_KERNEL to GFP_ATOMIC
in order to prevent atomic context sleeping. The GFP_ATOMIC flag
makes memory allocation operation could be used in atomic context.

Signed-off-by: Duoming Zhou <duoming@....edu.cn>
---
 drivers/staging/rtl8192u/r8192U_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
index ce807c9d421..679c362baad 100644
--- a/drivers/staging/rtl8192u/r8192U_core.c
+++ b/drivers/staging/rtl8192u/r8192U_core.c
@@ -267,7 +267,7 @@ int write_nic_byte(struct net_device *dev, int indx, u8 data)
 
 	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
 	struct usb_device *udev = priv->udev;
-	u8 *usbdata = kzalloc(sizeof(data), GFP_KERNEL);
+	u8 *usbdata = kzalloc(sizeof(data), GFP_ATOMIC);
 
 	if (!usbdata)
 		return -ENOMEM;
@@ -319,7 +319,7 @@ int write_nic_dword(struct net_device *dev, int indx, u32 data)
 
 	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
 	struct usb_device *udev = priv->udev;
-	u32 *usbdata = kzalloc(sizeof(data), GFP_KERNEL);
+	u32 *usbdata = kzalloc(sizeof(data), GFP_ATOMIC);
 
 	if (!usbdata)
 		return -ENOMEM;
-- 
2.17.1