| Message ID | 20220504055847.38026-1-duoming@zju.edu.cn (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 4071bf121d59944d5cd2238de0642f3d7995a997 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] NFC: netlink: fix sleep in atomic bug when firmware download timeout | expand |
On 04/05/2022 07:58, Duoming Zhou wrote: > There are sleep in atomic bug that could cause kernel panic during > firmware download process. The root cause is that nlmsg_new with > GFP_KERNEL parameter is called in fw_dnld_timeout which is a timer > handler. The call trace is shown below: > > BUG: sleeping function called from invalid context at include/linux/sched/mm.h:265 > Call Trace: > kmem_cache_alloc_node > __alloc_skb > nfc_genl_fw_download_done > call_timer_fn > __run_timers.part.0 > run_timer_softirq > __do_softirq > ... > > The nlmsg_new with GFP_KERNEL parameter may sleep during memory > allocation process, and the timer handler is run as the result of > a "software interrupt" that should not call any other function > that could sleep. > > This patch changes allocation mode of netlink message from GFP_KERNEL > to GFP_ATOMIC in order to prevent sleep in atomic bug. The GFP_ATOMIC > flag makes memory allocation operation could be used in atomic context. > > Fixes: 9674da8759df ("NFC: Add firmware upload netlink command") > Fixes: 9ea7187c53f6 ("NFC: netlink: Rename CMD_FW_UPLOAD to CMD_FW_DOWNLOAD") > Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Best regards, Krzysztof
Hello: This patch was applied to netdev/net.git (master) by Paolo Abeni <pabeni@redhat.com>: On Wed, 4 May 2022 13:58:47 +0800 you wrote: > There are sleep in atomic bug that could cause kernel panic during > firmware download process. The root cause is that nlmsg_new with > GFP_KERNEL parameter is called in fw_dnld_timeout which is a timer > handler. The call trace is shown below: > > BUG: sleeping function called from invalid context at include/linux/sched/mm.h:265 > Call Trace: > kmem_cache_alloc_node > __alloc_skb > nfc_genl_fw_download_done > call_timer_fn > __run_timers.part.0 > run_timer_softirq > __do_softirq > ... > > [...] Here is the summary with links: - [net] NFC: netlink: fix sleep in atomic bug when firmware download timeout https://git.kernel.org/netdev/net/c/4071bf121d59 You are awesome, thank you!
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c index f184b0db79d..7c62417ccfd 100644 --- a/net/nfc/netlink.c +++ b/net/nfc/netlink.c @@ -1244,7 +1244,7 @@ int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name, struct sk_buff *msg; void *hdr; - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); + msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); if (!msg) return -ENOMEM; @@ -1260,7 +1260,7 @@ int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name, genlmsg_end(msg, hdr); - genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL); + genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_ATOMIC); return 0;
There are sleep in atomic bug that could cause kernel panic during firmware download process. The root cause is that nlmsg_new with GFP_KERNEL parameter is called in fw_dnld_timeout which is a timer handler. The call trace is shown below: BUG: sleeping function called from invalid context at include/linux/sched/mm.h:265 Call Trace: kmem_cache_alloc_node __alloc_skb nfc_genl_fw_download_done call_timer_fn __run_timers.part.0 run_timer_softirq __do_softirq ... The nlmsg_new with GFP_KERNEL parameter may sleep during memory allocation process, and the timer handler is run as the result of a "software interrupt" that should not call any other function that could sleep. This patch changes allocation mode of netlink message from GFP_KERNEL to GFP_ATOMIC in order to prevent sleep in atomic bug. The GFP_ATOMIC flag makes memory allocation operation could be used in atomic context. Fixes: 9674da8759df ("NFC: Add firmware upload netlink command") Fixes: 9ea7187c53f6 ("NFC: netlink: Rename CMD_FW_UPLOAD to CMD_FW_DOWNLOAD") Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> --- net/nfc/netlink.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)