opl3: Fix a possible sleep-in-atomic bug in snd_opl3_find_patch

Commit Message

Jia-Ju Bai Oct. 9, 2017, 2:35 a.m. UTC

The driver may sleep under a spinlock, and the function call path is:
snd_opl3_note_on (acquire the spinlock)
  snd_opl3_find_patch
    kzalloc(GFP_KERNEL) --> may sleep

To fix it, GFP_KERNEL is replaced with GFP_ATOMIC.
This bug is found by my static analysis tool and my code review.

Signed-off-by: Jia-Ju Bai <[e-mail]>
---
 sound/drivers/opl3/opl3_synth.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Clemens Ladisch Oct. 9, 2017, 6:32 a.m. UTC | #1

Jia-Ju Bai wrote:
> The driver may sleep under a spinlock, and the function call path is:
> snd_opl3_note_on (acquire the spinlock)
>   snd_opl3_find_patch
>     kzalloc(GFP_KERNEL) --> may sleep

This call path is not possible because create_patch is not set.


Regards,
Clemens

Jia-Ju Bai Oct. 9, 2017, 7:51 a.m. UTC | #2

Thanks for your reply :)
Yes, you are right. Sorry for this false positive.


Thanks,
Jia-Ju Bai

On 2017/10/9 14:32, Clemens Ladisch wrote:
> Jia-Ju Bai wrote:
>> The driver may sleep under a spinlock, and the function call path is:
>> snd_opl3_note_on (acquire the spinlock)
>>    snd_opl3_find_patch
>>      kzalloc(GFP_KERNEL) --> may sleep
> This call path is not possible because create_patch is not set.
>
>
> Regards,
> Clemens

Patch

diff --git a/sound/drivers/opl3/opl3_synth.c b/sound/drivers/opl3/opl3_synth.c
index ddcc1a3..2e1cb2b 100644
--- a/sound/drivers/opl3/opl3_synth.c
+++ b/sound/drivers/opl3/opl3_synth.c
@@ -325,7 +325,7 @@  struct fm_patch *snd_opl3_find_patch(struct snd_opl3 *opl3, int prog, int bank,
 	if (!create_patch)
 		return NULL;
 
-	patch = kzalloc(sizeof(*patch), GFP_KERNEL);
+	patch = kzalloc(sizeof(*patch), GFP_ATOMIC);
 	if (!patch)
 		return NULL;
 	patch->prog = prog;