Messages in this thread Patch in this message | | | From | Jia-Ju Bai <> | Subject | [PATCH] net: scm: Fix a possible sleep-in-atomic-context bug in scm_fp_copy() | Date | Sat, 1 Sep 2018 18:00:26 +0800 |
| |
The kernel module may sleep with holding a spinlock.
The function call paths (from bottom to top) in Linux-4.16 are:
[FUNC] kmalloc(GFP_KERNEL) net/core/scm.c, 85: kmalloc in scm_fp_copy net/core/scm.c, 161: scm_fp_copy in __scm_send ./include/net/scm.h, 88: __scm_send in scm_send net/unix/af_unix.c, 1600: scm_send in maybe_init_creds net/unix/af_unix.c, 1983: maybe_init_creds in unix_stream_sendpage net/unix/af_unix.c, 1973: spin_lock in unix_stream_sendpage
To fix this bug, GFP_KERNEL is replaced with GFP_ATOMIC.
This bug is found by my static analysis tool DSAC.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> --- net/core/scm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/core/scm.c b/net/core/scm.c index b1ff8a441748..49548f81c45b 100644 --- a/net/core/scm.c +++ b/net/core/scm.c @@ -82,7 +82,7 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp) if (!fpl) { - fpl = kmalloc(sizeof(struct scm_fp_list), GFP_KERNEL); + fpl = kmalloc(sizeof(struct scm_fp_list), GFP_ATOMIC); if (!fpl) return -ENOMEM; *fplp = fpl; -- 2.17.0
| |