Re: [BUG] usb/io_edgeport: a possible sleep-in-atomic bug in edge_bulk_in_callback

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



[ +CC: linux-usb]

On Wed, Dec 13, 2017 at 06:22:26PM +0800, Jia-Ju Bai wrote:
> According to drivers/usb/serial/io_edgeport.c, the driver may sleep 
> under a spinlock.
> The function call path is:
> edge_bulk_in_callback (acquire the spinlock)
>    process_rcvd_data
>      process_rcvd_status
>        change_port_settings
>          send_iosp_ext_cmd
>            write_cmd_usb
>              usb_kill_urb --> may sleep
> 
> I do not find a good way to fix it, so I only report.
> This possible bug is found by my static analysis tool (DSAC) and checked 
> by my code review.

Good catch!

Fortunately, the fix here is just to remove that usb_kill_urb() from the
error path in write_cmd_usb() after usb_submit_urb() fails.

Care to submit a patch for that?

Thanks,
Johan
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux