2009-10-07 14:45:40

by Alexander Strakh

Subject: [BUG] znet.c sleeping function called from invalid context

KERNEL_VERSION: 2.6.31
DESCRIBE:
Driver drivers/net/znet.c might sleep in atomic context, because it calls
free_dma under claim_dma_lock:

.drivers/net/znet.c:
168 static int znet_request_resources (struct net_device *dev)
...
189 flags = claim_dma_lock();
190 free_dma (znet->tx_dma);
191 release_dma_lock (flags);
...

Path to might_sleep macro from znet_request_resources:
1. znet_request_resources calls free_dma at
arch/blackfin/kernel/bfin_dma_5xx.c:181
2. free_dma calls arch/blackfin/kernel/bfin_dma_5xx.c:195

Found by: Linux Driver Verification

2009-10-07 18:45:43

by Mike Frysinger

Subject: Re: [BUG] znet.c sleeping function called from invalid context

On Wed, Oct 7, 2009 at 14:47, Alexander Strakh wrote:
>        KERNEL_VERSION: 2.6.31
>        DESCRIBE:
> Driver drivers/net/znet.c might sleep in atomic context, because it calls
> free_dma under claim_dma_lock:
>
> .drivers/net/znet.c:
>  168 static int znet_request_resources (struct net_device *dev)
> ...
>  189        flags = claim_dma_lock();
>  190        free_dma (znet->tx_dma);
>  191        release_dma_lock (flags);
> ...
>
> Path to might_sleep macro from znet_request_resources:
> 1. znet_request_resources calls free_dma at
> arch/blackfin/kernel/bfin_dma_5xx.c:181
> 2. free_dma calls arch/blackfin/kernel/bfin_dma_5xx.c:195

i dont think we need the dmalock mutex. it's only used to protect
read/writes to .chan_status, and that should be atomic already.
-mike

2009-10-08 05:16:01

by David Miller

Subject: Re: [BUG] znet.c sleeping function called from invalid context

From: Mike Frysinger <[email protected]>
Date: Wed, 7 Oct 2009 14:44:45 -0400

> On Wed, Oct 7, 2009 at 14:47, Alexander Strakh wrote:
>> ? ? ? ?KERNEL_VERSION: 2.6.31
>> ? ? ? ?DESCRIBE:
>> Driver drivers/net/znet.c might sleep in atomic context, because it calls
>> free_dma under claim_dma_lock:
>>
>> .drivers/net/znet.c:
>> ?168 static int znet_request_resources (struct net_device *dev)
>> ...
>> ?189 ? ? ? ?flags = claim_dma_lock();
>> ?190 ? ? ? ?free_dma (znet->tx_dma);
>> ?191 ? ? ? ?release_dma_lock (flags);
>> ...
>>
>> Path to might_sleep macro from znet_request_resources:
>> 1. znet_request_resources calls free_dma at
>> arch/blackfin/kernel/bfin_dma_5xx.c:181
>> 2. free_dma calls arch/blackfin/kernel/bfin_dma_5xx.c:195
>
> i dont think we need the dmalock mutex. it's only used to protect
> read/writes to .chan_status, and that should be atomic already.
> -mike

I'm checking in the obvious fix to net-2.6, thanks for the report:

znet: Don't claim DMA lock around free_dma() calls.

It's not necessary and it's illegal too.

Reported-by: Alexander Strakh <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
---
drivers/net/znet.c | 8 --------
1 files changed, 0 insertions(+), 8 deletions(-)

diff --git a/drivers/net/znet.c b/drivers/net/znet.c
index a0384b6..b423473 100644
--- a/drivers/net/znet.c
+++ b/drivers/net/znet.c
@@ -169,7 +169,6 @@ static void znet_tx_timeout (struct net_device *dev);
static int znet_request_resources (struct net_device *dev)
{
struct znet_private *znet = netdev_priv(dev);
- unsigned long flags;

if (request_irq (dev->irq, &znet_interrupt, 0, "ZNet", dev))
goto failed;
@@ -187,13 +186,9 @@ static int znet_request_resources (struct net_device *dev)
free_sia:
release_region (znet->sia_base, znet->sia_size);
free_tx_dma:
- flags = claim_dma_lock();
free_dma (znet->tx_dma);
- release_dma_lock (flags);
free_rx_dma:
- flags = claim_dma_lock();
free_dma (znet->rx_dma);
- release_dma_lock (flags);
free_irq:
free_irq (dev->irq, dev);
failed:
@@ -203,14 +198,11 @@ static int znet_request_resources (struct net_device *dev)
static void znet_release_resources (struct net_device *dev)
{
struct znet_private *znet = netdev_priv(dev);
- unsigned long flags;

release_region (znet->sia_base, znet->sia_size);
release_region (dev->base_addr, znet->io_size);
- flags = claim_dma_lock();
free_dma (znet->tx_dma);
free_dma (znet->rx_dma);
- release_dma_lock (flags);
free_irq (dev->irq, dev);
}

--
1.6.4.4