korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-29 23:24:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

mISDN: hfcpci: Fix potential deadlock on &hc->lock

Browse Source 
As &hc->lock is acquired by both timer _hfcpci_softirq() and hardirq
hfcpci_int(), the timer should disable irq before lock acquisition
otherwise deadlock could happen if the timmer is preemtped by the hadr irq.

Possible deadlock scenario:
hfcpci_softirq() (timer)
    -> _hfcpci_softirq()
    -> spin_lock(&hc->lock);
        <irq interruption>
        -> hfcpci_int()
        -> spin_lock(&hc->lock); (deadlock here)

This flaw was found by an experimental static analysis tool I am developing
for irq-related deadlock.

The tentative patch fixes the potential deadlock by spin_lock_irq()
in timer.

Fixes: b36b654a7e ("mISDN: Create /sys/class/mISDN")
Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
Link: https://lore.kernel.org/r/20230727085619.7419-1-dg573847474@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Chengfeng Ye 2023-07-27 08:56:19 +00:00 committed by Jakub Kicinski
parent e68409db99
commit 56c6be35fc
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/isdn/hardware/mISDN/hfcpci.c
View File

@ -839,7 +839,7 @@ hfcpci_fill_fifo(struct bchannel *bch)
*z1t = cpu_to_le16(new_z1); /* now send data */ *z1t = cpu_to_le16(new_z1); /* now send data */
if (bch->tx_idx < bch->tx_skb->len) if (bch->tx_idx < bch->tx_skb->len)
return; return;
dev_kfree_skb(bch->tx_skb); dev_kfree_skb_any(bch->tx_skb);
if (get_next_bframe(bch)) if (get_next_bframe(bch))
goto next_t_frame; goto next_t_frame;
return; return;
@ -895,7 +895,7 @@ hfcpci_fill_fifo(struct bchannel *bch)
} }
bz->za[new_f1].z1 = cpu_to_le16(new_z1); /* for next buffer */ bz->za[new_f1].z1 = cpu_to_le16(new_z1); /* for next buffer */
bz->f1 = new_f1; /* next frame */ bz->f1 = new_f1; /* next frame */
dev_kfree_skb(bch->tx_skb); dev_kfree_skb_any(bch->tx_skb);
get_next_bframe(bch); get_next_bframe(bch);
} }
@ -1119,7 +1119,7 @@ tx_birq(struct bchannel *bch)
if (bch->tx_skb && bch->tx_idx < bch->tx_skb->len) if (bch->tx_skb && bch->tx_idx < bch->tx_skb->len)
hfcpci_fill_fifo(bch); hfcpci_fill_fifo(bch);
else { else {
dev_kfree_skb(bch->tx_skb); dev_kfree_skb_any(bch->tx_skb);
if (get_next_bframe(bch)) if (get_next_bframe(bch))
hfcpci_fill_fifo(bch); hfcpci_fill_fifo(bch);
} }
@ -2277,7 +2277,7 @@ _hfcpci_softirq(struct device *dev, void *unused)
return 0; return 0;
if (hc->hw.int_m2 & HFCPCI_IRQ_ENABLE) { if (hc->hw.int_m2 & HFCPCI_IRQ_ENABLE) {
spin_lock(&hc->lock); spin_lock_irq(&hc->lock);
bch = Sel_BCS(hc, hc->hw.bswapped ? 2 : 1); bch = Sel_BCS(hc, hc->hw.bswapped ? 2 : 1);
if (bch && bch->state == ISDN_P_B_RAW) { /* B1 rx&tx */ if (bch && bch->state == ISDN_P_B_RAW) { /* B1 rx&tx */
main_rec_hfcpci(bch); main_rec_hfcpci(bch);
@ -2288,7 +2288,7 @@ _hfcpci_softirq(struct device *dev, void *unused)
main_rec_hfcpci(bch); main_rec_hfcpci(bch);
tx_birq(bch); tx_birq(bch);
} }
spin_unlock(&hc->lock); spin_unlock_irq(&hc->lock);
} }
return 0; return 0;
} }