Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752273AbdLMI5f (ORCPT ); Wed, 13 Dec 2017 03:57:35 -0500 Received: from mail-pf0-f196.google.com ([209.85.192.196]:41695 "EHLO mail-pf0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751173AbdLMI5c (ORCPT ); Wed, 13 Dec 2017 03:57:32 -0500 X-Google-Smtp-Source: ACJfBouWRctPvFrOJguoQlsM1lJfmQY88jAClbD0VN00T8I931vkT+4CFA5ycu2/a+gcjgGA50UkHw== To: David Miller , tklauser@distanz.ch, johannes.berg@intel.com, arvind.yadav.cs@gmail.com, edumazet@google.com Cc: linux-usb@vger.kernel.org, netdev@vger.kernel.org, Linux Kernel Mailing List From: Jia-Ju Bai Subject: [BUG] kaweth: a possible sleep-in-atomic bug in kaweth_start_xmit Message-ID: <384f1b94-1fd1-cd38-f8ab-fcba872c77e9@gmail.com> Date: Wed, 13 Dec 2017 16:57:18 +0800 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.2.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 509 Lines: 18 According to drivers/net/usb/kaweth.c, the driver may sleep under a spinlock. The function call path is: kaweth_start_xmit (acquire the spinlock) kaweth_async_set_rx_mode kaweth_control kaweth_internal_control_msg usb_start_wait_urb wait_event_timeout --> may sleep usb_kill_urb --> may sleep I do not find a good way to fix it, so I only report. This possible bug is found by my static analysis tool (DSAC) and checked by my code review. Thanks, Jia-Ju Bai