| Message ID | 20220513133355.113222-1-duoming@zju.edu.cn (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc | expand |
On 13/05/2022 15:33, Duoming Zhou wrote: > There are sleep in atomic context bugs when the request to secure > element of st-nci is timeout. The root cause is that nci_skb_alloc > with GFP_KERNEL parameter is called in st_nci_se_wt_timeout which is > a timer handler. The call paths that could trigger bugs are shown below: > > (interrupt context 1) > st_nci_se_wt_timeout > nci_hci_send_event > nci_hci_send_data > nci_skb_alloc(..., GFP_KERNEL) //may sleep > > (interrupt context 2) > st_nci_se_wt_timeout > nci_hci_send_event > nci_hci_send_data > nci_send_data > nci_queue_tx_data_frags > nci_skb_alloc(..., GFP_KERNEL) //may sleep > > This patch changes allocation mode of nci_skb_alloc from GFP_KERNEL to > GFP_ATOMIC in order to prevent atomic context sleeping. The GFP_ATOMIC > flag makes memory allocation operation could be used in atomic context. > > Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation ") > Fixes: 11f54f228643 ("NFC: nci: Add HCI over NCI protocol support") > Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Best regards, Krzysztof
On Fri, 13 May 2022 21:33:55 +0800 Duoming Zhou wrote: > Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation ") > Fixes: 11f54f228643 ("NFC: nci: Add HCI over NCI protocol support") Are there more bad callers? If st_nci_se_wt_timeout is the only source of trouble then the fixes tag should point to when it was added, rather than when the callee was added.
Hello, On Mon, 16 May 2022 13:07:05 -0700 Jakub Kicinski wrote: > On Fri, 13 May 2022 21:33:55 +0800 Duoming Zhou wrote: > > Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation ") > > Fixes: 11f54f228643 ("NFC: nci: Add HCI over NCI protocol support") > > Are there more bad callers? If st_nci_se_wt_timeout is the only source > of trouble then the fixes tag should point to when it was added, rather > than when the callee was added. The st_nci_se_wt_timeout is the only source of trouble, it was added in ed06aeefdac3 ("nfc: st-nci: Rename st21nfcb to st-nci"). I will send patch v2. Best regards, Duoming Zhou
diff --git a/net/nfc/nci/data.c b/net/nfc/nci/data.c index 6055dc9a82a..aa5e712adf0 100644 --- a/net/nfc/nci/data.c +++ b/net/nfc/nci/data.c @@ -118,7 +118,7 @@ static int nci_queue_tx_data_frags(struct nci_dev *ndev, skb_frag = nci_skb_alloc(ndev, (NCI_DATA_HDR_SIZE + frag_len), - GFP_KERNEL); + GFP_ATOMIC); if (skb_frag == NULL) { rc = -ENOMEM; goto free_exit; diff --git a/net/nfc/nci/hci.c b/net/nfc/nci/hci.c index 19703a649b5..78c4b6addf1 100644 --- a/net/nfc/nci/hci.c +++ b/net/nfc/nci/hci.c @@ -153,7 +153,7 @@ static int nci_hci_send_data(struct nci_dev *ndev, u8 pipe, i = 0; skb = nci_skb_alloc(ndev, conn_info->max_pkt_payload_len + - NCI_DATA_HDR_SIZE, GFP_KERNEL); + NCI_DATA_HDR_SIZE, GFP_ATOMIC); if (!skb) return -ENOMEM; @@ -184,7 +184,7 @@ static int nci_hci_send_data(struct nci_dev *ndev, u8 pipe, if (i < data_len) { skb = nci_skb_alloc(ndev, conn_info->max_pkt_payload_len + - NCI_DATA_HDR_SIZE, GFP_KERNEL); + NCI_DATA_HDR_SIZE, GFP_ATOMIC); if (!skb) return -ENOMEM;
There are sleep in atomic context bugs when the request to secure element of st-nci is timeout. The root cause is that nci_skb_alloc with GFP_KERNEL parameter is called in st_nci_se_wt_timeout which is a timer handler. The call paths that could trigger bugs are shown below: (interrupt context 1) st_nci_se_wt_timeout nci_hci_send_event nci_hci_send_data nci_skb_alloc(..., GFP_KERNEL) //may sleep (interrupt context 2) st_nci_se_wt_timeout nci_hci_send_event nci_hci_send_data nci_send_data nci_queue_tx_data_frags nci_skb_alloc(..., GFP_KERNEL) //may sleep This patch changes allocation mode of nci_skb_alloc from GFP_KERNEL to GFP_ATOMIC in order to prevent atomic context sleeping. The GFP_ATOMIC flag makes memory allocation operation could be used in atomic context. Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation ") Fixes: 11f54f228643 ("NFC: nci: Add HCI over NCI protocol support") Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> --- net/nfc/nci/data.c | 2 +- net/nfc/nci/hci.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)