2009-10-08 08:20:29

by Alexander Strakh

Subject: [BUG] ali-ircc.c sleeping function called from invalid context

KERNEL_VERSION: 2.6.31
DESCRIBE:
Driver reports/drivers/net/irda/ali-ircc.c might sleep in attomic context,
because it calls ali_ircc_change_speed after spin_lock_irqsave:

drivers/net/irda/ali-ircc.c:
2028static int ali_ircc_net_ioctl(struct net_device *dev, struct ifreq *rq,
int cmd)
...
2056 spin_lock_irqsave(&self->lock, flags);
2057 ali_ircc_change_speed(self, irq->ifr_baudrate);
...

Path to might_sleep macro from ali_ircc_change_speed:
1. ali_ircc_change_speed calls ali_ircc_sir_change_speed
./drivers/net/irda/ali-ircc.c:999
2. ali_ircc_sir_change_speed calls spin_lock_irqsave at
./drivers/net/irda/ali-ircc.c:1084

Found by: Linux Driver Verification

2009-10-08 10:43:42

by Alexander Strakh

Subject: Re: [BUG] ali-ircc.c sleeping function called from invalid context

KERNEL_VERSION: 2.6.31
DESCRIBE:
(wrong message before that)
Driver reports/drivers/net/irda/ali-ircc.c - get spin_lock twice

drivers/net/irda/ali-ircc.c:
2028static int ali_ircc_net_ioctl(struct net_device *dev, struct ifreq *rq,
int cmd)
...
2056 ? ? ? ? ? ? ? ?spin_lock_irqsave(&self->lock, flags);
2057 ? ? ? ? ? ? ? ?ali_ircc_change_speed(self, irq->ifr_baudrate); ? ? ? ?
...

Path to second spin_lock_irqsave(&self->lock, flags) from
ali_ircc_change_speed:
1. ali_ircc_change_speed calls ali_ircc_sir_change_speed
./drivers/net/irda/ali-ircc.c:999
2. ali_ircc_sir_change_speed calls spin_lock_irqsave at
./drivers/net/irda/ali-ircc.c:1084:

1050static void ali_ircc_sir_change_speed(struct ali_ircc_cb *priv, __u32
speed)
1084 spin_lock_irqsave(&self->lock, flags);

Found by: Linux Driver Verification