| From 4d76e8fc294762ed5d5dd5963fb961c4ca4fbf34 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 19 Dec 2019 11:34:01 +0100 |
| Subject: media: sti: bdisp: fix a possible sleep-in-atomic-context bug in |
| bdisp_device_run() |
| |
| From: Jia-Ju Bai <baijiaju1990@gmail.com> |
| |
| [ Upstream commit bb6d42061a05d71dd73f620582d9e09c8fbf7f5b ] |
| |
| The driver may sleep while holding a spinlock. |
| The function call path (from bottom to top) in Linux 4.19 is: |
| |
| drivers/media/platform/sti/bdisp/bdisp-hw.c, 385: |
| msleep in bdisp_hw_reset |
| drivers/media/platform/sti/bdisp/bdisp-v4l2.c, 341: |
| bdisp_hw_reset in bdisp_device_run |
| drivers/media/platform/sti/bdisp/bdisp-v4l2.c, 317: |
| _raw_spin_lock_irqsave in bdisp_device_run |
| |
| To fix this bug, msleep() is replaced with udelay(). |
| |
| This bug is found by a static analysis tool STCheck written by myself. |
| |
| Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> |
| Reviewed-by: Fabien Dessenne <fabien.dessenne@st.com> |
| Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> |
| Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/media/platform/sti/bdisp/bdisp-hw.c | 6 +++--- |
| 1 file changed, 3 insertions(+), 3 deletions(-) |
| |
| diff --git a/drivers/media/platform/sti/bdisp/bdisp-hw.c b/drivers/media/platform/sti/bdisp/bdisp-hw.c |
| index 4372abbb5950f..a74e9fd652389 100644 |
| --- a/drivers/media/platform/sti/bdisp/bdisp-hw.c |
| +++ b/drivers/media/platform/sti/bdisp/bdisp-hw.c |
| @@ -14,8 +14,8 @@ |
| #define MAX_SRC_WIDTH 2048 |
| |
| /* Reset & boot poll config */ |
| -#define POLL_RST_MAX 50 |
| -#define POLL_RST_DELAY_MS 20 |
| +#define POLL_RST_MAX 500 |
| +#define POLL_RST_DELAY_MS 2 |
| |
| enum bdisp_target_plan { |
| BDISP_RGB, |
| @@ -382,7 +382,7 @@ int bdisp_hw_reset(struct bdisp_dev *bdisp) |
| for (i = 0; i < POLL_RST_MAX; i++) { |
| if (readl(bdisp->regs + BLT_STA1) & BLT_STA1_IDLE) |
| break; |
| - msleep(POLL_RST_DELAY_MS); |
| + udelay(POLL_RST_DELAY_MS * 1000); |
| } |
| if (i == POLL_RST_MAX) |
| dev_err(bdisp->dev, "Reset timeout\n"); |
| -- |
| 2.20.1 |
| |
