2019-02-11 13:10:51

by Christoph Hellwig

Subject: [PATCH] platform/x86: dell_rbu: fix lock imbalance in img_update_realloc

We need to ensure rbu_data.lock is always held on return.

Fixes: 289790a3ea94 ("platform/x86: dell_rbu: stop abusing the DMA API")
Reported-by: Dan Carpenter <[email protected]>
Signed-off-by: Christoph Hellwig <[email protected]>
---
drivers/platform/x86/dell_rbu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/x86/dell_rbu.c b/drivers/platform/x86/dell_rbu.c
index 8104ca0c44ca..031c68903583 100644
--- a/drivers/platform/x86/dell_rbu.c
+++ b/drivers/platform/x86/dell_rbu.c
@@ -436,6 +436,7 @@ static int img_update_realloc(unsigned long size)
ordernum = get_order(size);
image_update_buffer =
(unsigned char *)__get_free_pages(GFP_DMA32, ordernum);
+ spin_lock(&rbu_data.lock);
if (!image_update_buffer) {
pr_debug("Not enough memory for image update:"
"size = %ld\n", size);
@@ -446,7 +447,6 @@ static int img_update_realloc(unsigned long size)
if (WARN_ON_ONCE(img_buf_phys_addr > BIOS_SCAN_LIMIT))
return -EINVAL; /* can't happen per definition */

- spin_lock(&rbu_data.lock);
rbu_data.image_update_buffer = image_update_buffer;
rbu_data.image_update_buffer_size = size;
rbu_data.bios_image_size = rbu_data.image_update_buffer_size;
--
2.20.1

2019-02-13 09:19:43

by Stuart Hayes

Subject: Re: [PATCH] platform/x86: dell_rbu: fix lock imbalance in img_update_realloc

On 2/11/2019 7:09 AM, Christoph Hellwig wrote:
> We need to ensure rbu_data.lock is always held on return.
>
> Fixes: 289790a3ea94 ("platform/x86: dell_rbu: stop abusing the DMA API")
> Reported-by: Dan Carpenter <[email protected]>
> Signed-off-by: Christoph Hellwig <[email protected]>
> ---
> drivers/platform/x86/dell_rbu.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/platform/x86/dell_rbu.c b/drivers/platform/x86/dell_rbu.c
> index 8104ca0c44ca..031c68903583 100644
> --- a/drivers/platform/x86/dell_rbu.c
> +++ b/drivers/platform/x86/dell_rbu.c
> @@ -436,6 +436,7 @@ static int img_update_realloc(unsigned long size)
> ordernum = get_order(size);
> image_update_buffer =
> (unsigned char *)__get_free_pages(GFP_DMA32, ordernum);
> + spin_lock(&rbu_data.lock);
> if (!image_update_buffer) {
> pr_debug("Not enough memory for image update:"
> "size = %ld\n", size);
> @@ -446,7 +447,6 @@ static int img_update_realloc(unsigned long size)
> if (WARN_ON_ONCE(img_buf_phys_addr > BIOS_SCAN_LIMIT))
> return -EINVAL; /* can't happen per definition */
>
> - spin_lock(&rbu_data.lock);
> rbu_data.image_update_buffer = image_update_buffer;
> rbu_data.image_update_buffer_size = size;
> rbu_data.bios_image_size = rbu_data.image_update_buffer_size;
>

Acked-by: Stuart Hayes <[email protected]>

2019-02-16 07:08:21

by Andy Shevchenko

Subject: Re: [PATCH] platform/x86: dell_rbu: fix lock imbalance in img_update_realloc

On Wed, Feb 13, 2019 at 5:56 AM Stuart Hayes <[email protected]> wrote:
>
>
>
> On 2/11/2019 7:09 AM, Christoph Hellwig wrote:
> > We need to ensure rbu_data.lock is always held on return.
> >

Pushed to my review and testing queue, thanks!

> > Fixes: 289790a3ea94 ("platform/x86: dell_rbu: stop abusing the DMA API")
> > Reported-by: Dan Carpenter <[email protected]>
> > Signed-off-by: Christoph Hellwig <[email protected]>
> > ---
> > drivers/platform/x86/dell_rbu.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/platform/x86/dell_rbu.c b/drivers/platform/x86/dell_rbu.c
> > index 8104ca0c44ca..031c68903583 100644
> > --- a/drivers/platform/x86/dell_rbu.c
> > +++ b/drivers/platform/x86/dell_rbu.c
> > @@ -436,6 +436,7 @@ static int img_update_realloc(unsigned long size)
> > ordernum = get_order(size);
> > image_update_buffer =
> > (unsigned char *)__get_free_pages(GFP_DMA32, ordernum);
> > + spin_lock(&rbu_data.lock);
> > if (!image_update_buffer) {
> > pr_debug("Not enough memory for image update:"
> > "size = %ld\n", size);
> > @@ -446,7 +447,6 @@ static int img_update_realloc(unsigned long size)
> > if (WARN_ON_ONCE(img_buf_phys_addr > BIOS_SCAN_LIMIT))
> > return -EINVAL; /* can't happen per definition */
> >
> > - spin_lock(&rbu_data.lock);
> > rbu_data.image_update_buffer = image_update_buffer;
> > rbu_data.image_update_buffer_size = size;
> > rbu_data.bios_image_size = rbu_data.image_update_buffer_size;
> >
>
> Acked-by: Stuart Hayes <[email protected]>



--
With Best Regards,
Andy Shevchenko