2017-06-05 01:29:24

by Jia-Ju Bai

Subject: [PATCH] rts5208: Fix a sleep-in-atomic bug in sd_send_cmd_get_rsp

The driver may sleep under a spin lock, and the function call path is:
rtsx_exclusive_enter_ss (acquire the lock by spin_lock)
rtsx_enter_ss
rtsx_power_off_card
sd_cleanup_work
sd_stop_seq_mode
sd_switch_clock
sd_ddr_tuning
sd_ddr_pre_tuning_tx
sd_send_cmd_get_rsp
wait_timeout
schedule_timeout --> may sleep

To fix it, "wait_timeout" is replaced with mdelay in sd_send_cmd_get_rsp.

Signed-off-by: Jia-Ju Bai <[email protected]>
---
drivers/staging/rts5208/sd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/rts5208/sd.c b/drivers/staging/rts5208/sd.c
index bdd35b6..fed17ff 100644
--- a/drivers/staging/rts5208/sd.c
+++ b/drivers/staging/rts5208/sd.c
@@ -226,7 +226,7 @@ static int sd_send_cmd_get_rsp(struct rtsx_chip *chip, u8 cmd_idx,
return STATUS_FAIL;
}
if (rty_cnt < SD_MAX_RETRY_COUNT) {
- wait_timeout(20);
+ mdelay(20);
rty_cnt++;
goto RTY_SEND_CMD;
} else {
--
1.7.9.5

2017-06-13 09:42:07

by Greg Kroah-Hartman

Subject: Re: [PATCH] rts5208: Fix a sleep-in-atomic bug in sd_send_cmd_get_rsp

On Mon, Jun 05, 2017 at 09:31:36AM +0800, Jia-Ju Bai wrote:
> The driver may sleep under a spin lock, and the function call path is:
> rtsx_exclusive_enter_ss (acquire the lock by spin_lock)
> rtsx_enter_ss
> rtsx_power_off_card
> sd_cleanup_work
> sd_stop_seq_mode
> sd_switch_clock
> sd_ddr_tuning
> sd_ddr_pre_tuning_tx
> sd_send_cmd_get_rsp
> wait_timeout
> schedule_timeout --> may sleep
>
> To fix it, "wait_timeout" is replaced with mdelay in sd_send_cmd_get_rsp.
>
> Signed-off-by: Jia-Ju Bai <[email protected]>
> ---
> drivers/staging/rts5208/sd.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)

You sent 3 copies of this patch, and I have no idea which to take.
Please fix up and resend the _one_ that is correct.

thanks,

greg k-h