Patch "NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc" has been added to the 5.17-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc

to the 5.17-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     nfc-nci-fix-sleep-in-atomic-context-bugs-caused-by-n.patch
and it can be found in the queue-5.17 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit bb20d4ba7e65492e8b1df076f3d2ecd30c4d6ffe
Author: Duoming Zhou <duoming@xxxxxxxxxx>
Date:   Tue May 17 09:25:30 2022 +0800

    NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc
    
    [ Upstream commit 23dd4581350d4ffa23d58976ec46408f8f4c1e16 ]
    
    There are sleep in atomic context bugs when the request to secure
    element of st-nci is timeout. The root cause is that nci_skb_alloc
    with GFP_KERNEL parameter is called in st_nci_se_wt_timeout which is
    a timer handler. The call paths that could trigger bugs are shown below:
    
        (interrupt context 1)
    st_nci_se_wt_timeout
      nci_hci_send_event
        nci_hci_send_data
          nci_skb_alloc(..., GFP_KERNEL) //may sleep
    
       (interrupt context 2)
    st_nci_se_wt_timeout
      nci_hci_send_event
        nci_hci_send_data
          nci_send_data
            nci_queue_tx_data_frags
              nci_skb_alloc(..., GFP_KERNEL) //may sleep
    
    This patch changes allocation mode of nci_skb_alloc from GFP_KERNEL to
    GFP_ATOMIC in order to prevent atomic context sleeping. The GFP_ATOMIC
    flag makes memory allocation operation could be used in atomic context.
    
    Fixes: ed06aeefdac3 ("nfc: st-nci: Rename st21nfcb to st-nci")
    Signed-off-by: Duoming Zhou <duoming@xxxxxxxxxx>
    Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20220517012530.75714-1-duoming@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/nfc/nci/data.c b/net/nfc/nci/data.c
index 6055dc9a82aa..aa5e712adf07 100644
--- a/net/nfc/nci/data.c
+++ b/net/nfc/nci/data.c
@@ -118,7 +118,7 @@ static int nci_queue_tx_data_frags(struct nci_dev *ndev,
 
 		skb_frag = nci_skb_alloc(ndev,
 					 (NCI_DATA_HDR_SIZE + frag_len),
-					 GFP_KERNEL);
+					 GFP_ATOMIC);
 		if (skb_frag == NULL) {
 			rc = -ENOMEM;
 			goto free_exit;
diff --git a/net/nfc/nci/hci.c b/net/nfc/nci/hci.c
index 19703a649b5a..78c4b6addf15 100644
--- a/net/nfc/nci/hci.c
+++ b/net/nfc/nci/hci.c
@@ -153,7 +153,7 @@ static int nci_hci_send_data(struct nci_dev *ndev, u8 pipe,
 
 	i = 0;
 	skb = nci_skb_alloc(ndev, conn_info->max_pkt_payload_len +
-			    NCI_DATA_HDR_SIZE, GFP_KERNEL);
+			    NCI_DATA_HDR_SIZE, GFP_ATOMIC);
 	if (!skb)
 		return -ENOMEM;
 
@@ -184,7 +184,7 @@ static int nci_hci_send_data(struct nci_dev *ndev, u8 pipe,
 		if (i < data_len) {
 			skb = nci_skb_alloc(ndev,
 					    conn_info->max_pkt_payload_len +
-					    NCI_DATA_HDR_SIZE, GFP_KERNEL);
+					    NCI_DATA_HDR_SIZE, GFP_ATOMIC);
 			if (!skb)
 				return -ENOMEM;