Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752228AbdLLJ0N (ORCPT ); Tue, 12 Dec 2017 04:26:13 -0500 Received: from m12-17.163.com ([220.181.12.17]:56670 "EHLO m12-17.163.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750915AbdLLJ0J (ORCPT ); Tue, 12 Dec 2017 04:26:09 -0500 From: Jia-Ju Bai To: johannes@sipsolutions.net, kvalo@codeaurora.org, j@w1.fi, jlopex@gmail.com Cc: linux-wireless@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Jia-Ju Bai Subject: [PATCH] mac80211_hwsim: Fix a possible sleep-in-atomic bug in hwsim_get_radio_nl Date: Tue, 12 Dec 2017 17:26:36 +0800 Message-Id: <1513070796-24283-1-git-send-email-baijiaju1990@163.com> X-Mailer: git-send-email 1.7.9.5 X-CM-TRANSID: EcCowAD3_9c9oC9asZlGDQ--.62860S2 X-Coremail-Antispam: 1Uf129KBjvdXoW7GF48CF4DXrWxAr1xKr4Durg_yoWDAFX_Wr 4xXrnxAr97JwnI9r40krW29FW2krWUWr18ua9aqrWSyws8JrW5Jas5Zry7Cr9xWa1xAFWr XwsrJFn5Aw12qjkaLaAFLSUrUUUUUb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUvcSsGvfC2KfnxnUUI43ZEXa7IUb0387UUUUU== X-Originating-IP: [166.111.70.15] X-CM-SenderInfo: xedlyx5dmximizq6il2tof0z/1tbiHgKselSIYTcztgAAsF Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 988 Lines: 30 The driver may sleep under a spinlock. The function call path is: hwsim_get_radio_nl (acquire the spinlock) nlmsg_new(GFP_KERNEL) --> may sleep To fix it, GFP_KERNEL is replaced with GFP_ATOMIC. This bug is found by my static analysis tool(DSAC) and checked by my code review. Signed-off-by: Jia-Ju Bai --- drivers/net/wireless/mac80211_hwsim.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c index 10b075a..f2ebf4a 100644 --- a/drivers/net/wireless/mac80211_hwsim.c +++ b/drivers/net/wireless/mac80211_hwsim.c @@ -3215,7 +3215,7 @@ static int hwsim_get_radio_nl(struct sk_buff *msg, struct genl_info *info) if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info))) continue; - skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); + skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); if (!skb) { res = -ENOMEM; goto out_err; -- 1.7.9.5