2017-12-13 09:25:51

by Jia-Ju Bai

Subject: [PATCH] bluecard: Fix a possible sleep-in-atomic bug in bluecard_write_wakeup

The driver may sleep in the interrupt handler.
The function call path is:
bluecard_interrupt (interrupt handler)
bluecard_write_wakeup
schedule_timeout --> may sleep

To fix it, schedule_timeout is replaced with mdelay.

This bug is found by my static analysis tool(DSAC) and checked by my code review.

Signed-off-by: Jia-Ju Bai <[email protected]>
---
drivers/bluetooth/bluecard_cs.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/drivers/bluetooth/bluecard_cs.c b/drivers/bluetooth/bluecard_cs.c
index d513ef4..82437a6 100644
--- a/drivers/bluetooth/bluecard_cs.c
+++ b/drivers/bluetooth/bluecard_cs.c
@@ -302,9 +302,7 @@ static void bluecard_write_wakeup(struct bluecard_info *info)
}

/* Wait until the command reaches the baseband */
- prepare_to_wait(&wq, &wait, TASK_INTERRUPTIBLE);
- schedule_timeout(HZ/10);
- finish_wait(&wq, &wait);
+ mdelay(100);

/* Set baud on baseband */
info->ctrl_reg &= ~0x03;
@@ -316,9 +314,7 @@ static void bluecard_write_wakeup(struct bluecard_info *info)
outb(info->ctrl_reg, iobase + REG_CONTROL);

/* Wait before the next HCI packet can be send */
- prepare_to_wait(&wq, &wait, TASK_INTERRUPTIBLE);
- schedule_timeout(HZ);
- finish_wait(&wq, &wait);
+ mdelay(1000);
}

if (len == skb->len) {
--
1.7.9.5

2017-12-13 13:39:49

by Marcel Holtmann

Subject: Re: [PATCH] bluecard: Fix a possible sleep-in-atomic bug in bluecard_write_wakeup

Hi Jia-Ju,

> The driver may sleep in the interrupt handler.
> The function call path is:
> bluecard_interrupt (interrupt handler)
> bluecard_write_wakeup
> schedule_timeout --> may sleep
>
> To fix it, schedule_timeout is replaced with mdelay.
>
> This bug is found by my static analysis tool(DSAC) and checked by my code review.
>
> Signed-off-by: Jia-Ju Bai <[email protected]>
> ---
> drivers/bluetooth/bluecard_cs.c | 8 ++------
> 1 file changed, 2 insertions(+), 6 deletions(-)

patch has been applied to bluetooth-next tree.

Regards

Marcel