summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorJia-Ju Bai <baijiaju1990@gmail.com>2019-12-18 12:21:55 +0300
committerDavid S. Miller <davem@davemloft.net>2019-12-18 22:57:33 +0300
commitb7ac893652cafadcf669f78452329727e4e255cc (patch)
tree10873b8b1c06ef6e5bf1b7eabc3d59f9480175bd /net
parentddd9b5e3e765d8ed5a35786a6cb00111713fe161 (diff)
downloadlinux-b7ac893652cafadcf669f78452329727e4e255cc.tar.xz
net: nfc: nci: fix a possible sleep-in-atomic-context bug in nci_uart_tty_receive()
The kernel may sleep while holding a spinlock. The function call path (from bottom to top) in Linux 4.19 is: net/nfc/nci/uart.c, 349: nci_skb_alloc in nci_uart_default_recv_buf net/nfc/nci/uart.c, 255: (FUNC_PTR)nci_uart_default_recv_buf in nci_uart_tty_receive net/nfc/nci/uart.c, 254: spin_lock in nci_uart_tty_receive nci_skb_alloc(GFP_KERNEL) can sleep at runtime. (FUNC_PTR) means a function pointer is called. To fix this bug, GFP_KERNEL is replaced with GFP_ATOMIC for nci_skb_alloc(). This bug is found by a static analysis tool STCheck written by myself. Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/nfc/nci/uart.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/nfc/nci/uart.c b/net/nfc/nci/uart.c
index 78fe622eba65..11b554ce07ff 100644
--- a/net/nfc/nci/uart.c
+++ b/net/nfc/nci/uart.c
@@ -346,7 +346,7 @@ static int nci_uart_default_recv_buf(struct nci_uart *nu, const u8 *data,
nu->rx_packet_len = -1;
nu->rx_skb = nci_skb_alloc(nu->ndev,
NCI_MAX_PACKET_SIZE,
- GFP_KERNEL);
+ GFP_ATOMIC);
if (!nu->rx_skb)
return -ENOMEM;
}