[PATCH] staging: rtl8188eu: Fix two sleep-in-atomic-context bugs in rtw_chk_hi_queue_cmd()
usb_write_port_complete() in usb_ops_linux.c is a completion handler
function for the USB driver. So it should not sleep, but it is can sleep
according to the function call paths (from bottom to top) in Linux-4.16:
[FUNC] kzalloc(GFP_KERNEL)
drivers/staging/rtl8188eu/core/rtw_cmd.c, 1081:
kzalloc in rtw_chk_hi_queue_cmd
drivers/staging/rtl8188eu/os_dep/usb_ops_linux.c, 604:
rtw_chk_hi_queue_cmd in usb_write_port_complete
[FUNC] kzalloc(GFP_KERNEL)
drivers/staging/rtl8188eu/core/rtw_cmd.c, 1075:
kzalloc in rtw_chk_hi_queue_cmd
drivers/staging/rtl8188eu/os_dep/usb_ops_linux.c, 604:
rtw_chk_hi_queue_cmd in usb_write_port_complete
To fix these bugs, GFP_KERNEL is replaced with GFP_ATOMIC.
These bugs are found by my static analysis tool DSAC.
Signed-off-by: Jia-Ju Bai
---
drivers/staging/rtl8188eu/core/rtw_cmd.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/rtl8188eu/core/rtw_cmd.c
b/drivers/staging/rtl8188eu/core/rtw_cmd.c
index 72099f5d6915..526baa699a57 100644
--- a/drivers/staging/rtl8188eu/core/rtw_cmd.c
+++ b/drivers/staging/rtl8188eu/core/rtw_cmd.c
@@ -1072,13 +1072,13 @@ u8 rtw_chk_hi_queue_cmd(struct adapter *padapter)
struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
u8 res = _SUCCESS;
- ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
+ ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
if (!ph2c) {
res = _FAIL;
goto exit;
}
- pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm),
GFP_KERNEL);
+ pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm),
GFP_ATOMIC);
if (!pdrvextra_cmd_parm) {
kfree(ph2c);
res = _FAIL;
--
2.17.0
___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
[PATCH v2] Staging: rtlwifi: efuse: Fixed a line length code styling issue.
Fixed a code styling issue.
Signed-off-by: Tom Todd
---
drivers/staging/rtlwifi/efuse.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/rtlwifi/efuse.c b/drivers/staging/rtlwifi/efuse.c
index 1dc71455f270..abb0f720cf21 100644
--- a/drivers/staging/rtlwifi/efuse.c
+++ b/drivers/staging/rtlwifi/efuse.c
@@ -245,7 +245,8 @@ void read_efuse(struct ieee80211_hw *hw, u16 _offset, u16
_size_byte, u8 *pbuf)
if (!efuse_word)
goto out;
for (i = 0; i < EFUSE_MAX_WORD_UNIT; i++) {
- efuse_word[i] = kcalloc(efuse_max_section, sizeof(u16),
GFP_ATOMIC);
+ efuse_word[i] = kcalloc(efuse_max_section, sizeof(u16),
+ GFP_ATOMIC);
if (!efuse_word[i])
goto done;
}
--
2.18.0
___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
Re: [PATCH RFCv2 0/6] mm: online/offline_pages called w.o. mem_hotplug_lock
On 31.08.2018 22:54, Oscar Salvador wrote: > On Tue, Aug 21, 2018 at 12:44:12PM +0200, David Hildenbrand wrote: >> This is the same approach as in the first RFC, but this time without >> exporting device_hotplug_lock (requested by Greg) and with some more >> details and documentation regarding locking. Tested only on x86 so far. > > Hi David, > > I would like to review this but I am on vacation, so I will not be able to > get to it > soon. > I plan to do it once I am back. Sure, I won't be resending within next two weeks either way, as I am also on vacation. Have a nice vacation! > > Thanks > -- Thanks, David / dhildenb ___ devel mailing list de...@linuxdriverproject.org http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
Re: [PATCH] staging: android: ion: fix ION_IOC_{MAP,SHARE} use-after-free
On Fri, Aug 31, 2018 at 01:30:01PM -0700, Greg Hackmann wrote: > On 08/31/2018 01:27 PM, Greg Hackmann wrote: > > Change-Id: Ia0542dd8134e81cd5e1412e126545303c766f738 > > Sorry, please disregard the Change-Id line. This is what I get for > forgetting to re-run checkpatch after amending my commit message. :/ Can you please resend with that fixed up. Having to hand-edit patches on my end is a royal pain... thanks, greg k-h ___ devel mailing list de...@linuxdriverproject.org http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
Re: [PATCH net-next v2 0/2] dpaa2-eth: Move DPAA2 Ethernet driver
From: Ioana Radulescu Date: Wed, 29 Aug 2018 04:42:38 -0500 > The Freescale/NXP DPAA2 Ethernet driver was first included in > drivers/staging, due to its dependencies on two components located > there at the time of its initial submission: > * the fsl-mc bus driver, which was moved to drivers/bus in kernel 4.17 > * the dpio driver, which was moved to drivers/soc/fsl in kernel 4.18 > > More information on the DPAA2 architecture and the interactions > between the fsl-mc bus and the objects present on it can be found in: > Documentation/networking/dpaa2/overview.rst > > For easier review, the patch is generated without the -M option, > although the driver files are moved without any code changes. > > changes since v1[1]: > * remove RFC label, since dependencies have been merged on net-next > * add patch fixing a possible race at probe (reported by Andrew Lunn) > > [1] https://lore.kernel.org/patchwork/patch/971333/ Series applied, thank you. ___ devel mailing list de...@linuxdriverproject.org http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
Re: [PATCH net-next 1/2] PCI: hv: support reporting serial number as slot information
From: Stephen Hemminger
Date: Wed, 29 Aug 2018 09:24:51 -0700
> + spin_lock_irqsave(&hbus->device_list_lock, flags);
> + list_for_each_entry(hpdev, &hbus->children, list_entry) {
> + if (hpdev->pci_slot)
> + continue;
> +
> + slot_nr = PCI_SLOT(wslot_to_devfn(hpdev->desc.win_slot.slot));
> + snprintf(name, SLOT_NAME_SIZE, "%u", hpdev->desc.ser);
> + hpdev->pci_slot = pci_create_slot(hbus->pci_bus, slot_nr,
> + name, NULL);
pci_create_slot() takes a mutex, therefore you can't hold a spinlock or
disable interrupts here.
___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
