| From 3b722c0a6b3fbb343a0330a37380571850bc55b2 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Sat, 1 Sep 2018 07:44:09 -0400 |
| Subject: media: pci: ivtv: Fix a sleep-in-atomic-context bug in |
| ivtv_yuv_init() |
| |
| From: Jia-Ju Bai <baijiaju1990@gmail.com> |
| |
| [ Upstream commit 8d11eb847de7d89c2754988c944d51a4f63e219b ] |
| |
| The driver may sleep in a interrupt handler. |
| |
| The function call paths (from bottom to top) in Linux-4.16 are: |
| |
| [FUNC] kzalloc(GFP_KERNEL) |
| drivers/media/pci/ivtv/ivtv-yuv.c, 938: |
| kzalloc in ivtv_yuv_init |
| drivers/media/pci/ivtv/ivtv-yuv.c, 960: |
| ivtv_yuv_init in ivtv_yuv_next_free |
| drivers/media/pci/ivtv/ivtv-yuv.c, 1126: |
| ivtv_yuv_next_free in ivtv_yuv_setup_stream_frame |
| drivers/media/pci/ivtv/ivtv-irq.c, 827: |
| ivtv_yuv_setup_stream_frame in ivtv_irq_dec_data_req |
| drivers/media/pci/ivtv/ivtv-irq.c, 1013: |
| ivtv_irq_dec_data_req in ivtv_irq_handler |
| |
| To fix this bug, GFP_KERNEL is replaced with GFP_ATOMIC. |
| |
| This bug is found by my static analysis tool DSAC. |
| |
| Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> |
| Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> |
| Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/media/pci/ivtv/ivtv-yuv.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/drivers/media/pci/ivtv/ivtv-yuv.c b/drivers/media/pci/ivtv/ivtv-yuv.c |
| index 44936d6d7c396..1380474519f2b 100644 |
| --- a/drivers/media/pci/ivtv/ivtv-yuv.c |
| +++ b/drivers/media/pci/ivtv/ivtv-yuv.c |
| @@ -935,7 +935,7 @@ static void ivtv_yuv_init(struct ivtv *itv) |
| } |
| |
| /* We need a buffer for blanking when Y plane is offset - non-fatal if we can't get one */ |
| - yi->blanking_ptr = kzalloc(720 * 16, GFP_KERNEL|__GFP_NOWARN); |
| + yi->blanking_ptr = kzalloc(720 * 16, GFP_ATOMIC|__GFP_NOWARN); |
| if (yi->blanking_ptr) { |
| yi->blanking_dmaptr = pci_map_single(itv->pdev, yi->blanking_ptr, 720*16, PCI_DMA_TODEVICE); |
| } else { |
| -- |
| 2.20.1 |
| |
