Messages in this thread | | | Date | Mon, 16 May 2022 18:18:45 +0800 (GMT+08:00) | From | duoming@zju ... | Subject | Re: [PATCH net] NFC: hci: fix sleep in atomic context bugs in nfc_hci_hcp_message_tx |
| |
Hello,
On Mon, 16 May 2022 08:44:39 +0200 Krzysztof wrote:
> > There are sleep in atomic context bugs when the request to secure > > element of st21nfca is timeout. The root cause is that kzalloc and > > alloc_skb with GFP_KERNEL parameter is called in st21nfca_se_wt_timeout > > which is a timer handler. The call tree shows the execution paths that > > could lead to bugs: > > > > (Interrupt context) > > st21nfca_se_wt_timeout > > nfc_hci_send_event > > nfc_hci_hcp_message_tx > > kzalloc(..., GFP_KERNEL) //may sleep > > alloc_skb(..., GFP_KERNEL) //may sleep > > > > This patch changes allocation mode of kzalloc and alloc_skb from > > GFP_KERNEL to GFP_ATOMIC in order to prevent atomic context from > > sleeping. The GFP_ATOMIC flag makes memory allocation operation > > could be used in atomic context. > > > > Fixes: 8b8d2e08bf0d ("NFC: HCI support") > > Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> > > --- > > net/nfc/hci/hcp.c | 4 ++-- > > 1 file changed, 2 insertions(+), 2 deletions(-) > > > > diff --git a/net/nfc/hci/hcp.c b/net/nfc/hci/hcp.c > > index 05c60988f59..1caf9c2086f 100644 > > --- a/net/nfc/hci/hcp.c > > +++ b/net/nfc/hci/hcp.c > > @@ -30,7 +30,7 @@ int nfc_hci_hcp_message_tx(struct nfc_hci_dev *hdev, u8 pipe, > > int hci_len, err; > > bool firstfrag = true; > > > > - cmd = kzalloc(sizeof(struct hci_msg), GFP_KERNEL); > > + cmd = kzalloc(sizeof(*cmd), GFP_ATOMIC); > > No, this does not look correct. This function can sleep, so it can use > GFP_KERNEL. Please just look at the function before replacing any flags...
I am sorry, I don`t understand why nfc_hci_hcp_message_tx() can sleep.
I think st21nfca_se_wt_timeout() is a timer handler, which is in interrupt context. The call tree shows the execution paths that could lead to bugs:
st21nfca_hci_se_io() mod_timer(&info->se_info.bwi_timer,...) st21nfca_se_wt_timeout() //timer handler, interrupt context nfc_hci_send_event() nfc_hci_hcp_message_tx() kzalloc(..., GFP_KERNEL) //may sleep alloc_skb(..., GFP_KERNEL) //may sleep
What`s more, I think the "mutex_lock(&hdev->msg_tx_mutex)" called by nfc_hci_hcp_message_tx() is also improper.
Please correct me, If you think I am wrong. Thanks for your time.
Best regards, Duoming Zhou
| |