There are sleep in atomic bug that could cause kernel panic during
firmware download process. The root cause is that nlmsg_new with
GFP_KERNEL parameter is called in fw_dnld_timeout which is a timer
handler. The call trace is shown below:
BUG: sleeping function called from invalid context at include/linux/sched/mm.h:265
Call Trace:
kmem_cache_alloc_node
__alloc_skb
nfc_genl_fw_download_done
call_timer_fn
__run_timers.part.0
run_timer_softirq
__do_softirq
...
The nlmsg_new with GFP_KERNEL parameter may sleep during memory
allocation process, and the timer handler is run as the result of
a "software interrupt" that should not call any other function
that could sleep.
This patch changes allocation mode of netlink message from GFP_KERNEL
to GFP_ATOMIC in order to prevent sleep in atomic bug. The GFP_ATOMIC
flag makes memory allocation operation could be used in atomic context.
Fixes: 9674da8759df ("NFC: Add firmware upload netlink command")
Fixes: 9ea7187c53f6 ("NFC: netlink: Rename CMD_FW_UPLOAD to CMD_FW_DOWNLOAD")
Signed-off-by: Duoming Zhou <[email protected]>
---
net/nfc/netlink.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index f184b0db79d..7c62417ccfd 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -1244,7 +1244,7 @@ int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name,
struct sk_buff *msg;
void *hdr;
- msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+ msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
if (!msg)
return -ENOMEM;
@@ -1260,7 +1260,7 @@ int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name,
genlmsg_end(msg, hdr);
- genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL);
+ genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_ATOMIC);
return 0;
--
2.17.1
On 04/05/2022 07:58, Duoming Zhou wrote:
> There are sleep in atomic bug that could cause kernel panic during
> firmware download process. The root cause is that nlmsg_new with
> GFP_KERNEL parameter is called in fw_dnld_timeout which is a timer
> handler. The call trace is shown below:
>
> BUG: sleeping function called from invalid context at include/linux/sched/mm.h:265
> Call Trace:
> kmem_cache_alloc_node
> __alloc_skb
> nfc_genl_fw_download_done
> call_timer_fn
> __run_timers.part.0
> run_timer_softirq
> __do_softirq
> ...
>
> The nlmsg_new with GFP_KERNEL parameter may sleep during memory
> allocation process, and the timer handler is run as the result of
> a "software interrupt" that should not call any other function
> that could sleep.
>
> This patch changes allocation mode of netlink message from GFP_KERNEL
> to GFP_ATOMIC in order to prevent sleep in atomic bug. The GFP_ATOMIC
> flag makes memory allocation operation could be used in atomic context.
>
> Fixes: 9674da8759df ("NFC: Add firmware upload netlink command")
> Fixes: 9ea7187c53f6 ("NFC: netlink: Rename CMD_FW_UPLOAD to CMD_FW_DOWNLOAD")
> Signed-off-by: Duoming Zhou <[email protected]>
Reviewed-by: Krzysztof Kozlowski <[email protected]>
Best regards,
Krzysztof
Hello:
This patch was applied to netdev/net.git (master)
by Paolo Abeni <[email protected]>:
On Wed, 4 May 2022 13:58:47 +0800 you wrote:
> There are sleep in atomic bug that could cause kernel panic during
> firmware download process. The root cause is that nlmsg_new with
> GFP_KERNEL parameter is called in fw_dnld_timeout which is a timer
> handler. The call trace is shown below:
>
> BUG: sleeping function called from invalid context at include/linux/sched/mm.h:265
> Call Trace:
> kmem_cache_alloc_node
> __alloc_skb
> nfc_genl_fw_download_done
> call_timer_fn
> __run_timers.part.0
> run_timer_softirq
> __do_softirq
> ...
>
> [...]
Here is the summary with links:
- [net] NFC: netlink: fix sleep in atomic bug when firmware download timeout
https://git.kernel.org/netdev/net/c/4071bf121d59
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html