From 1c8cb89ee9f8c0785bc1437f14ad01304acd91aa Mon Sep 17 00:00:00 2001 From: Jia-Ju Bai Date: Sat, 15 Sep 2018 10:49:28 +0800 Subject: staging: rtl8723bs: Fix a sleep-in-atomic-context bug in issue_deauth_ex() The driver may sleep with holding a spinlock. The function call paths (from bottom to top) in Linux-4.17 are: [FUNC] msleep drivers/staging/rtl8723bs/core/rtw_mlme_ext.c, 3805: msleep in issue_deauth_ex drivers/staging/rtl8723bs/core/rtw_mlme_ext.c, 6336: issue_deauth_ex in disconnect_hdl drivers/staging/rtl8723bs/core/rtw_cmd.c, 963: disconnect_hdl in rtw_disassoc_cmd drivers/staging/rtl8723bs/core/rtw_ioctl_set.c, 506: rtw_disassoc_cmd in rtw_set_802_11_disassociate drivers/staging/rtl8723bs/core/rtw_ioctl_set.c, 501: spin_lock_bh in rtw_set_802_11_disassociate [FUNC] msleep drivers/staging/rtl8723bs/core/rtw_mlme_ext.c, 3805: msleep in issue_deauth_ex drivers/staging/rtl8723bs/core/rtw_mlme_ext.c, 6336: issue_deauth_ex in disconnect_hdl drivers/staging/rtl8723bs/core/rtw_cmd.c, 963: disconnect_hdl in rtw_disassoc_cmd drivers/staging/rtl8723bs/core/rtw_mlme.c, 2256: rtw_disassoc_cmd in rtw_select_and_join_from_scanned_queue drivers/staging/rtl8723bs/core/rtw_mlme.c, 2204: spin_lock_bh in rtw_select_and_join_from_scanned_queue To fix this bug, msleep() is replaced with mdelay(). This bug is found by my static analysis tool DSAC. Signed-off-by: Jia-Ju Bai Signed-off-by: Greg Kroah-Hartman --- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/staging/rtl8723bs/core') diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c index 0952d15f6d40..bf055935ef65 100644 --- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c @@ -3796,7 +3796,7 @@ int issue_deauth_ex(struct adapter *padapter, u8 *da, unsigned short reason, int break; if (i < try_cnt && wait_ms > 0 && ret == _FAIL) - msleep(wait_ms); + mdelay(wait_ms); } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0))); -- cgit v1.2.3-55-g7522