| From foo@baz Sun Aug 26 09:13:00 CEST 2018 |
| From: Jia-Ju Bai <baijiaju1990@gmail.com> |
| Date: Wed, 20 Jun 2018 11:54:53 +0800 |
| Subject: usb: gadget: r8a66597: Fix two possible sleep-in-atomic-context bugs in init_controller() |
| |
| From: Jia-Ju Bai <baijiaju1990@gmail.com> |
| |
| [ Upstream commit 0602088b10a7c0b4e044a810678ef93d7cc5bf48 ] |
| |
| The driver may sleep with holding a spinlock. |
| The function call paths (from bottom to top) in Linux-4.16.7 are: |
| |
| [FUNC] msleep |
| drivers/usb/gadget/udc/r8a66597-udc.c, 839: |
| msleep in init_controller |
| drivers/usb/gadget/udc/r8a66597-udc.c, 96: |
| init_controller in r8a66597_usb_disconnect |
| drivers/usb/gadget/udc/r8a66597-udc.c, 93: |
| spin_lock in r8a66597_usb_disconnect |
| |
| [FUNC] msleep |
| drivers/usb/gadget/udc/r8a66597-udc.c, 835: |
| msleep in init_controller |
| drivers/usb/gadget/udc/r8a66597-udc.c, 96: |
| init_controller in r8a66597_usb_disconnect |
| drivers/usb/gadget/udc/r8a66597-udc.c, 93: |
| spin_lock in r8a66597_usb_disconnect |
| |
| To fix these bugs, msleep() is replaced with mdelay(). |
| |
| This bug is found by my static analysis tool (DSAC-2) and checked by |
| my code review. |
| |
| Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> |
| Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com> |
| Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/usb/gadget/udc/r8a66597-udc.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/usb/gadget/udc/r8a66597-udc.c |
| +++ b/drivers/usb/gadget/udc/r8a66597-udc.c |
| @@ -835,11 +835,11 @@ static void init_controller(struct r8a66 |
| |
| r8a66597_bset(r8a66597, XCKE, SYSCFG0); |
| |
| - msleep(3); |
| + mdelay(3); |
| |
| r8a66597_bset(r8a66597, PLLC, SYSCFG0); |
| |
| - msleep(1); |
| + mdelay(1); |
| |
| r8a66597_bset(r8a66597, SCKE, SYSCFG0); |
| |
