lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 13 Dec 2017 17:47:48 +0800 From: Jia-Ju Bai <baijiaju1990@...il.com> To: perex@...ex.cz, floeff@...hematik.uni-stuttgart.de, acme@...ectiva.com.br Cc: netdev@...r.kernel.org, linux-kernel@...r.kernel.org, Jia-Ju Bai <baijiaju1990@...il.com> Subject: [PATCH 1/2] hp100: Fix a possible sleep-in-atomic bug in hp100_login_to_vg_hub The driver may sleep under a spinlock. The function call path is: hp100_set_multicast_list (acquire the spinlock) hp100_login_to_vg_hub schedule_timeout_interruptible --> may sleep To fix it, schedule_timeout_interruptible is replaced with udelay. This bug is found by my static analysis tool(DSAC) and checked by my code review. Signed-off-by: Jia-Ju Bai <baijiaju1990@...il.com> --- drivers/net/ethernet/hp/hp100.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/drivers/net/ethernet/hp/hp100.c b/drivers/net/ethernet/hp/hp100.c index c8c7ad2..6addcbd 100644 --- a/drivers/net/ethernet/hp/hp100.c +++ b/drivers/net/ethernet/hp/hp100.c @@ -2636,8 +2636,7 @@ static int hp100_login_to_vg_hub(struct net_device *dev, u_short force_relogin) do { if (~(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST)) break; - if (!in_interrupt()) - schedule_timeout_interruptible(1); + udelay(10); } while (time_after(time, jiffies)); /* Start an addressed training and optionally request promiscuous port */ @@ -2672,8 +2671,7 @@ static int hp100_login_to_vg_hub(struct net_device *dev, u_short force_relogin) do { if (hp100_inb(VG_LAN_CFG_1) & HP100_LINK_CABLE_ST) break; - if (!in_interrupt()) - schedule_timeout_interruptible(1); + udelay(10); } while (time_before(jiffies, time)); if (time_after_eq(jiffies, time)) { @@ -2696,8 +2694,7 @@ static int hp100_login_to_vg_hub(struct net_device *dev, u_short force_relogin) #endif break; } - if (!in_interrupt()) - schedule_timeout_interruptible(1); + udelay(10); } while (time_after(time, jiffies)); } -- 1.7.9.5
Powered by blists - more mailing lists