From: "Rangankar, Manish" <Manish.Rangankar@cavium.com>
To: Jia-Ju Bai <baijiaju1990@gmail.com>,
        Dept-Eng QLogic Storage Upstream 
        <QLogic-Storage-Upstream@cavium.com>,
        "jejb@linux.vnet.ibm.com" <jejb@linux.vnet.ibm.com>,
        "martin.petersen@oracle.com" <martin.petersen@oracle.com>
CC: "linux-scsi@vger.kernel.org" <linux-scsi@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] qedi: Fix a possible sleep-in-atomic bug in
 qedi_process_tmf_resp
Thread-Topic: [PATCH] qedi: Fix a possible sleep-in-atomic bug in
 qedi_process_tmf_resp
Thread-Index: AQHTc/H/oAs9Khu9bEWqBkbD5fWK2KNBWTYA
Date: Wed, 13 Dec 2017 09:12:11 +0000
Message-ID: <D656EC82.4ACF8%manish.rangankar@cavium.com>
References: <1513156268-13328-1-git-send-email-baijiaju1990@gmail.com>
In-Reply-To: <1513156268-13328-1-git-send-email-baijiaju1990@gmail.com>
Accept-Language: en-US
Content-Language: en-US
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="us-ascii"
Content-ID: <352840AEB62B484492A03B8585BF37CC@namprd07.prod.outlook.com>
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 16ef99bd-7e8f-4e6d-3fc6-08d5420997f5
X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Dec 2017 09:12:11.2958
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 711e4ccf-2e9b-4bcf-a551-4094005b6194
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR07MB2482
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by nfs id vBD9CawX016279
Content-Length: 1278
Lines: 45


On 13/12/17 2:41 PM, "Jia-Ju Bai" <baijiaju1990@gmail.com> wrote:

>The driver may sleep under a spinlock.
>The function call path is:
>qedi_cpu_offline (acquire the spinlock)
>  qedi_fp_process_cqes
>    qedi_mtask_completion
>      qedi_process_tmf_resp
>        kzalloc(GFP_KERNEL) --> may sleep
>
>To fix it, GFP_KERNEL is replaced with GFP_ATOMIC.
>
>This bug is found by my static analysis tool(DSAC) and checked by my code
>review.
>
>Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
>---
> drivers/scsi/qedi/qedi_fw.c |    2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/drivers/scsi/qedi/qedi_fw.c b/drivers/scsi/qedi/qedi_fw.c
>index bd302d3..20a9259 100644
>--- a/drivers/scsi/qedi/qedi_fw.c
>+++ b/drivers/scsi/qedi/qedi_fw.c
>@@ -198,7 +198,7 @@ static void qedi_process_tmf_resp(struct qedi_ctx
>*qedi,
> 	cqe_tmp_response = &cqe->cqe_common.iscsi_hdr.tmf_response;
> 
> 	qedi_cmd = task->dd_data;
>-	qedi_cmd->tmf_resp_buf = kzalloc(sizeof(*resp_hdr_ptr), GFP_KERNEL);
>+	qedi_cmd->tmf_resp_buf = kzalloc(sizeof(*resp_hdr_ptr), GFP_ATOMIC);
> 	if (!qedi_cmd->tmf_resp_buf) {
> 		QEDI_ERR(&qedi->dbg_ctx,
> 			 "Failed to allocate resp buf, cid=0x%x\n",
>-- 
>1.7.9.5

Thanks,

Acked-by: Manish Rangankar <Manish.Rangankar@cavium.com>

>