• Jia-Ju Bai's avatar
    usb: gadget: udc: fotg210-udc: Fix a sleep-in-atomic-context bug in fotg210_get_status() · 2337a77c
    Jia-Ju Bai authored
    The driver may sleep in an interrupt handler.
    The function call path (from bottom to top) in Linux-4.17 is:
    
    [FUNC] fotg210_ep_queue(GFP_KERNEL)
    drivers/usb/gadget/udc/fotg210-udc.c, 744:
    	fotg210_ep_queue in fotg210_get_status
    drivers/usb/gadget/udc/fotg210-udc.c, 768:
    	fotg210_get_status in fotg210_setup_packet
    drivers/usb/gadget/udc/fotg210-udc.c, 949:
    	fotg210_setup_packet in fotg210_irq (interrupt handler)
    
    To fix this bug, GFP_KERNEL is replaced with GFP_ATOMIC.
    If possible, spin_unlock() and spin_lock() around fotg210_ep_queue()
    can be also removed.
    
    This bug is found by my static analysis tool DSAC.
    Signed-off-by: default avatarJia-Ju Bai <baijiaju1990@gmail.com>
    Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
    2337a77c
fotg210-udc.c 28.7 KB