2018-09-15 04:07:20

by Jia-Ju Bai

Subject: [PATCH] net: socionext: Fix two sleep-in-atomic-context bugs in ave_rxfifo_reset()

The driver may sleep with holding a spinlock.
The function call paths (from bottom to top) in Linux-4.17 are:

[FUNC] usleep_range
drivers/net/ethernet/socionext/sni_ave.c, 892:
usleep_range in ave_rxfifo_reset
drivers/net/ethernet/socionext/sni_ave.c, 932:
ave_rxfifo_reset in ave_irq_handler

[FUNC] usleep_range
drivers/net/ethernet/socionext/sni_ave.c, 888:
usleep_range in ave_rxfifo_reset
drivers/net/ethernet/socionext/sni_ave.c, 932:
ave_rxfifo_reset in ave_irq_handler

To fix these bugs, usleep_range() is replaced with udelay().

These bugs are found by my static analysis tool DSAC.

Signed-off-by: Jia-Ju Bai <[email protected]>
---
drivers/net/ethernet/socionext/sni_ave.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/socionext/sni_ave.c b/drivers/net/ethernet/socionext/sni_ave.c
index f7ecceeb1e28..3c784a29ce0d 100644
--- a/drivers/net/ethernet/socionext/sni_ave.c
+++ b/drivers/net/ethernet/socionext/sni_ave.c
@@ -904,11 +904,11 @@ static void ave_rxfifo_reset(struct net_device *ndev)

/* assert reset */
writel(AVE_GRR_RXFFR, priv->base + AVE_GRR);
- usleep_range(40, 50);
+ udelay(50);

/* negate reset */
writel(0, priv->base + AVE_GRR);
- usleep_range(10, 20);
+ udelay(20);

/* negate interrupt status */
writel(AVE_GI_RXOVF, priv->base + AVE_GISR);
--
2.17.0

2018-09-18 02:03:42

by David Miller

Subject: Re: [PATCH] net: socionext: Fix two sleep-in-atomic-context bugs in ave_rxfifo_reset()

From: Jia-Ju Bai <[email protected]>
Date: Sat, 15 Sep 2018 12:02:46 +0800

> The driver may sleep with holding a spinlock.
> The function call paths (from bottom to top) in Linux-4.17 are:
>
> [FUNC] usleep_range
> drivers/net/ethernet/socionext/sni_ave.c, 892:
> usleep_range in ave_rxfifo_reset
> drivers/net/ethernet/socionext/sni_ave.c, 932:
> ave_rxfifo_reset in ave_irq_handler
>
> [FUNC] usleep_range
> drivers/net/ethernet/socionext/sni_ave.c, 888:
> usleep_range in ave_rxfifo_reset
> drivers/net/ethernet/socionext/sni_ave.c, 932:
> ave_rxfifo_reset in ave_irq_handler
>
> To fix these bugs, usleep_range() is replaced with udelay().
>
> These bugs are found by my static analysis tool DSAC.
>
> Signed-off-by: Jia-Ju Bai <[email protected]>

Applied to net-next.