• Jia-Ju Bai's avatar
    usb: gadget: udc: fix possible sleep-in-atomic-context bugs in gr_probe() · 9c1ed62a
    Jia-Ju Bai authored
    The driver may sleep while holding a spinlock.
    The function call path (from bottom to top) in Linux 4.19 is:
    
    drivers/usb/gadget/udc/core.c, 1175:
    	kzalloc(GFP_KERNEL) in usb_add_gadget_udc_release
    drivers/usb/gadget/udc/core.c, 1272:
    	usb_add_gadget_udc_release in usb_add_gadget_udc
    drivers/usb/gadget/udc/gr_udc.c, 2186:
    	usb_add_gadget_udc in gr_probe
    drivers/usb/gadget/udc/gr_udc.c, 2183:
    	spin_lock in gr_probe
    
    drivers/usb/gadget/udc/core.c, 1195:
    	mutex_lock in usb_add_gadget_udc_release
    drivers/usb/gadget/udc/core.c, 1272:
    	usb_add_gadget_udc_release in usb_add_gadget_udc
    drivers/usb/gadget/udc/gr_udc.c, 2186:
    	usb_add_gadget_udc in gr_probe
    drivers/usb/gadget/udc/gr_udc.c, 2183:
    	spin_lock in gr_probe
    
    drivers/usb/gadget/udc/gr_udc.c, 212:
    	debugfs_create_file in gr_probe
    drivers/usb/gadget/udc/gr_udc.c, 2197:
    	gr_dfs_create in gr_probe
    drivers/usb/gadget/udc/gr_udc.c, 2183:
        spin_lock in gr_probe
    
    drivers/usb/gadget/udc/gr_udc.c, 2114:
    	devm_request_threaded_irq in gr_request_irq
    drivers/usb/gadget/udc/gr_udc.c, 2202:
    	gr_request_irq in gr_probe
    drivers/usb/gadget/udc/gr_udc.c, 2183:
        spin_lock in gr_probe
    
    kzalloc(GFP_KERNEL), mutex_lock(), debugfs_create_file() and
    devm_request_threaded_irq() can sleep at runtime.
    
    To fix these possible bugs, usb_add_gadget_udc(), gr_dfs_create() and
    gr_request_irq() are called without handling the spinlock.
    
    These bugs are found by a static analysis tool STCheck written by myself.
    Signed-off-by: default avatarJia-Ju Bai <baijiaju1990@gmail.com>
    Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    9c1ed62a
gr_udc.c 55.2 KB