• Jia-Ju Bai's avatar
    net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx · 92181ec1
    Jia-Ju Bai authored
    [ Upstream commit f146e872 ]
    
    The kernel may sleep under a rcu read lock in cfpkt_create_pfx, and the
    function call path is:
    cfcnfg_linkup_rsp (acquire the lock by rcu_read_lock)
      cfctrl_linkdown_req
        cfpkt_create
          cfpkt_create_pfx
            alloc_skb(GFP_KERNEL) --> may sleep
    cfserl_receive (acquire the lock by rcu_read_lock)
      cfpkt_split
        cfpkt_create_pfx
          alloc_skb(GFP_KERNEL) --> may sleep
    
    There is "in_interrupt" in cfpkt_create_pfx to decide use "GFP_KERNEL" or
    "GFP_ATOMIC". In this situation, "GFP_KERNEL" is used because the function
    is called under a rcu read lock, instead in interrupt.
    
    To fix it, only "GFP_ATOMIC" is used in cfpkt_create_pfx.
    Signed-off-by: default avatarJia-Ju Bai <baijiaju1990@163.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    Signed-off-by: default avatarSasha Levin <alexander.levin@verizon.com>
    92181ec1
cfpkt_skbuff.c 8.36 KB