Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1654107 > unrolled thread

[PATCH] b43legacy: Fix a sleep-in-atomic bug in b43legacy_attr_interfmode_store

Back to article view | Back to linux.kernel

Contents

  [PATCH] b43legacy: Fix a sleep-in-atomic bug in b43legacy_attr_interfmode_store Jia-Ju Bai <baijiaju1990@163.com> - 2017-05-31 12:30 +0200
    Re: [PATCH] b43legacy: Fix a sleep-in-atomic bug in  b43legacy_attr_interfmode_store Michael Büsch <m@bues.ch> - 2017-05-31 17:20 +0200
    Re: [PATCH] b43legacy: Fix a sleep-in-atomic bug in  b43legacy_attr_interfmode_store Larry Finger <Larry.Finger@lwfinger.net> - 2017-05-31 19:40 +0200
      Re: [PATCH] b43legacy: Fix a sleep-in-atomic bug in b43legacy_attr_interfmode_store Jia-Ju Bai <baijiaju1990@163.com> - 2017-06-01 03:10 +0200
        Re: [PATCH] b43legacy: Fix a sleep-in-atomic bug in b43legacy_attr_interfmode_store Kalle Valo <kvalo@codeaurora.org> - 2017-06-01 06:20 +0200
        Re: [PATCH] b43legacy: Fix a sleep-in-atomic bug in  b43legacy_attr_interfmode_store Jonathan Corbet <corbet@lwn.net> - 2017-06-01 18:20 +0200
          Re: [PATCH] b43legacy: Fix a sleep-in-atomic bug in  b43legacy_attr_interfmode_store Larry Finger <Larry.Finger@lwfinger.net> - 2017-06-01 19:50 +0200
          Re: [PATCH] b43legacy: Fix a sleep-in-atomic bug in b43legacy_attr_interfmode_store Jia-Ju Bai <baijiaju1990@163.com> - 2017-06-02 03:20 +0200

#1654107 — [PATCH] b43legacy: Fix a sleep-in-atomic bug in b43legacy_attr_interfmode_store

The driver may sleep under a spin lock, and the function call path is:
b43legacy_attr_interfmode_store (acquire the lock by spin_lock_irqsave)
  b43legacy_radio_set_interference_mitigation
    b43legacy_radio_interference_mitigation_disable
      b43legacy_calc_nrssi_slope
        b43legacy_synth_pu_workaround
          might_sleep and msleep --> may sleep

Fixing it may be complex, and a possible way is to remove 
spin_lock_irqsave and spin_lock_irqrestore in 
b43legacy_attr_interfmode_store, and the code has been protected by
mutex_lock and mutex_unlock.

Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
---
 drivers/net/wireless/broadcom/b43legacy/sysfs.c |    2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/net/wireless/broadcom/b43legacy/sysfs.c b/drivers/net/wireless/broadcom/b43legacy/sysfs.c
index 2a1da15..9ede143 100644
--- a/drivers/net/wireless/broadcom/b43legacy/sysfs.c
+++ b/drivers/net/wireless/broadcom/b43legacy/sysfs.c
@@ -137,14 +137,12 @@ static ssize_t b43legacy_attr_interfmode_store(struct device *dev,
 	}
 
 	mutex_lock(&wldev->wl->mutex);
-	spin_lock_irqsave(&wldev->wl->irq_lock, flags);
 
 	err = b43legacy_radio_set_interference_mitigation(wldev, mode);
 	if (err)
 		b43legacyerr(wldev->wl, "Interference Mitigation not "
 		       "supported by device\n");
 	mmiowb();
-	spin_unlock_irqrestore(&wldev->wl->irq_lock, flags);
 	mutex_unlock(&wldev->wl->mutex);
 
 	return err ? err : count;
-- 
1.7.9.5

[toc] | [next] | [standalone]

#1654340 — Re: [PATCH] b43legacy: Fix a sleep-in-atomic bug in b43legacy_attr_interfmode_store

[Multipart message — attachments visible in raw view] — view raw

On Wed, 31 May 2017 18:29:07 +0800
Jia-Ju Bai <baijiaju1990@163.com> wrote:

> The driver may sleep under a spin lock, and the function call path is:
> b43legacy_attr_interfmode_store (acquire the lock by spin_lock_irqsave)
>   b43legacy_radio_set_interference_mitigation
>     b43legacy_radio_interference_mitigation_disable
>       b43legacy_calc_nrssi_slope
>         b43legacy_synth_pu_workaround
>           might_sleep and msleep --> may sleep
> 
> Fixing it may be complex, and a possible way is to remove 
> spin_lock_irqsave and spin_lock_irqrestore in 
> b43legacy_attr_interfmode_store, and the code has been protected by
> mutex_lock and mutex_unlock.
> 
> Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
> ---
>  drivers/net/wireless/broadcom/b43legacy/sysfs.c |    2 --
>  1 file changed, 2 deletions(-)
> 
> diff --git a/drivers/net/wireless/broadcom/b43legacy/sysfs.c b/drivers/net/wireless/broadcom/b43legacy/sysfs.c
> index 2a1da15..9ede143 100644
> --- a/drivers/net/wireless/broadcom/b43legacy/sysfs.c
> +++ b/drivers/net/wireless/broadcom/b43legacy/sysfs.c
> @@ -137,14 +137,12 @@ static ssize_t b43legacy_attr_interfmode_store(struct device *dev,
>  	}
>  
>  	mutex_lock(&wldev->wl->mutex);
> -	spin_lock_irqsave(&wldev->wl->irq_lock, flags);
>  
>  	err = b43legacy_radio_set_interference_mitigation(wldev, mode);
>  	if (err)
>  		b43legacyerr(wldev->wl, "Interference Mitigation not "
>  		       "supported by device\n");
>  	mmiowb();
> -	spin_unlock_irqrestore(&wldev->wl->irq_lock, flags);
>  	mutex_unlock(&wldev->wl->mutex);
>  
>  	return err ? err : count;


Interference mitigation has never been properly implemented and tested.
As such nobody should use it and I would be surprised if anybody uses
this attribute.
So I would suggest to remove this sysfs attribute entirely instead of
having this incorrect fix.

-- 
Michael

[toc] | [prev] | [next] | [standalone]

#1654485 — Re: [PATCH] b43legacy: Fix a sleep-in-atomic bug in b43legacy_attr_interfmode_store

On 05/31/2017 05:29 AM, Jia-Ju Bai wrote:
> The driver may sleep under a spin lock, and the function call path is:
> b43legacy_attr_interfmode_store (acquire the lock by spin_lock_irqsave)
>    b43legacy_radio_set_interference_mitigation
>      b43legacy_radio_interference_mitigation_disable
>        b43legacy_calc_nrssi_slope
>          b43legacy_synth_pu_workaround
>            might_sleep and msleep --> may sleep
> 
> Fixing it may be complex, and a possible way is to remove
> spin_lock_irqsave and spin_lock_irqrestore in
> b43legacy_attr_interfmode_store, and the code has been protected by
> mutex_lock and mutex_unlock.
> 
> Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
> ---
>   drivers/net/wireless/broadcom/b43legacy/sysfs.c |    2 --
>   1 file changed, 2 deletions(-)
> 
> diff --git a/drivers/net/wireless/broadcom/b43legacy/sysfs.c b/drivers/net/wireless/broadcom/b43legacy/sysfs.c
> index 2a1da15..9ede143 100644
> --- a/drivers/net/wireless/broadcom/b43legacy/sysfs.c
> +++ b/drivers/net/wireless/broadcom/b43legacy/sysfs.c
> @@ -137,14 +137,12 @@ static ssize_t b43legacy_attr_interfmode_store(struct device *dev,
>   	}
>   
>   	mutex_lock(&wldev->wl->mutex);
> -	spin_lock_irqsave(&wldev->wl->irq_lock, flags);
>   
>   	err = b43legacy_radio_set_interference_mitigation(wldev, mode);
>   	if (err)
>   		b43legacyerr(wldev->wl, "Interference Mitigation not "
>   		       "supported by device\n");
>   	mmiowb();
> -	spin_unlock_irqrestore(&wldev->wl->irq_lock, flags);
>   	mutex_unlock(&wldev->wl->mutex);
>   
>   	return err ? err : count;
> 

Jia-Ju,

Did you actually observe the attempt to sleep under the spin lock, or did you 
discover this using some tool? In other words, have either of your patches been 
tested?

Larry

[toc] | [prev] | [next] | [standalone]

#1654741

On 06/01/2017 01:33 AM, Larry Finger wrote:
> On 05/31/2017 05:29 AM, Jia-Ju Bai wrote:
>> The driver may sleep under a spin lock, and the function call path is:
>> b43legacy_attr_interfmode_store (acquire the lock by spin_lock_irqsave)
>>    b43legacy_radio_set_interference_mitigation
>>      b43legacy_radio_interference_mitigation_disable
>>        b43legacy_calc_nrssi_slope
>>          b43legacy_synth_pu_workaround
>>            might_sleep and msleep --> may sleep
>>
>> Fixing it may be complex, and a possible way is to remove
>> spin_lock_irqsave and spin_lock_irqrestore in
>> b43legacy_attr_interfmode_store, and the code has been protected by
>> mutex_lock and mutex_unlock.
>>
>> Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
>> ---
>>   drivers/net/wireless/broadcom/b43legacy/sysfs.c |    2 --
>>   1 file changed, 2 deletions(-)
>>
>> diff --git a/drivers/net/wireless/broadcom/b43legacy/sysfs.c 
>> b/drivers/net/wireless/broadcom/b43legacy/sysfs.c
>> index 2a1da15..9ede143 100644
>> --- a/drivers/net/wireless/broadcom/b43legacy/sysfs.c
>> +++ b/drivers/net/wireless/broadcom/b43legacy/sysfs.c
>> @@ -137,14 +137,12 @@ static ssize_t 
>> b43legacy_attr_interfmode_store(struct device *dev,
>>       }
>>         mutex_lock(&wldev->wl->mutex);
>> -    spin_lock_irqsave(&wldev->wl->irq_lock, flags);
>>         err = b43legacy_radio_set_interference_mitigation(wldev, mode);
>>       if (err)
>>           b43legacyerr(wldev->wl, "Interference Mitigation not "
>>                  "supported by device\n");
>>       mmiowb();
>> -    spin_unlock_irqrestore(&wldev->wl->irq_lock, flags);
>>       mutex_unlock(&wldev->wl->mutex);
>>         return err ? err : count;
>>
>
> Jia-Ju,
>
> Did you actually observe the attempt to sleep under the spin lock, or 
> did you discover this using some tool? In other words, have either of 
> your patches been tested?
>
> Larry
>
Hi,

In fact, my reported bugs are found by a static analysis tool written by 
me, and they are checked by my review of the driver code.
I admit my patches are not well tested, and they may not well fix the bugs.
I am looking forward to opinions and suggestions :)

Thanks,
Jia-Ju Bai

[toc] | [prev] | [next] | [standalone]

#1654794

Jia-Ju Bai <baijiaju1990@163.com> writes:

>> Did you actually observe the attempt to sleep under the spin lock,
>> or did you discover this using some tool? In other words, have
>> either of your patches been tested?
>
> In fact, my reported bugs are found by a static analysis tool written
> by me, and they are checked by my review of the driver code.

It's valuable information to add to the commit log how you found the
bug. If you check other wireless commits you can see comments like
"Found by spatch", "Coverity reported" quite frequently. So I recommend
that you also mention your tool in the commit log, makes understanding
the background of the patch easier.

-- 
Kalle Valo

[toc] | [prev] | [next] | [standalone]

#1655374 — Re: [PATCH] b43legacy: Fix a sleep-in-atomic bug in b43legacy_attr_interfmode_store

On Thu, 01 Jun 2017 09:05:07 +0800
Jia-Ju Bai <baijiaju1990@163.com> wrote:

> I admit my patches are not well tested, and they may not well fix the bugs.
> I am looking forward to opinions and suggestions :)

May I politely suggest that sending out untested locking changes is a
dangerous thing to do?  You really should not be changing the locking in a
piece of kernel code without understanding very well what the lock is
protecting and being able to say why your changes are safe.  Without that,
the risk of introducing subtle bugs is very high.

It looks like you have written a useful tool that could help us to make
the kernel more robust.  If you are interested in my suggestion, I would
recommend that you post the sleep-in-atomic scenarios that you are
finding, but refrain from "fixing" them in any case where you cannot offer
a strong explanation of why your fix is correct.

Thanks for working to find bugs in the kernel!

jon

[toc] | [prev] | [next] | [standalone]

#1655630 — Re: [PATCH] b43legacy: Fix a sleep-in-atomic bug in b43legacy_attr_interfmode_store

On 06/01/2017 11:11 AM, Jonathan Corbet wrote:
> On Thu, 01 Jun 2017 09:05:07 +0800
> Jia-Ju Bai <baijiaju1990@163.com> wrote:
> 
>> I admit my patches are not well tested, and they may not well fix the bugs.
>> I am looking forward to opinions and suggestions :)
> 
> May I politely suggest that sending out untested locking changes is a
> dangerous thing to do?  You really should not be changing the locking in a
> piece of kernel code without understanding very well what the lock is
> protecting and being able to say why your changes are safe.  Without that,
> the risk of introducing subtle bugs is very high.
> 
> It looks like you have written a useful tool that could help us to make
> the kernel more robust.  If you are interested in my suggestion, I would
> recommend that you post the sleep-in-atomic scenarios that you are
> finding, but refrain from "fixing" them in any case where you cannot offer
> a strong explanation of why your fix is correct.
> 
> Thanks for working to find bugs in the kernel!

I agree with the suggestion above. Locking changes should only be done in 
conjunction with testing by someone that actually has the hardware.

Larry

[toc] | [prev] | [next] | [standalone]

#1655830

On 06/02/2017 12:11 AM, Jonathan Corbet wrote:
> On Thu, 01 Jun 2017 09:05:07 +0800
> Jia-Ju Bai<baijiaju1990@163.com>  wrote:
>
>> I admit my patches are not well tested, and they may not well fix the bugs.
>> I am looking forward to opinions and suggestions :)
> May I politely suggest that sending out untested locking changes is a
> dangerous thing to do?  You really should not be changing the locking in a
> piece of kernel code without understanding very well what the lock is
> protecting and being able to say why your changes are safe.  Without that,
> the risk of introducing subtle bugs is very high.
>
> It looks like you have written a useful tool that could help us to make
> the kernel more robust.  If you are interested in my suggestion, I would
> recommend that you post the sleep-in-atomic scenarios that you are
> finding, but refrain from "fixing" them in any case where you cannot offer
> a strong explanation of why your fix is correct.
>
> Thanks for working to find bugs in the kernel!
>
> jon
Hi,

Thanks for your good and helpful advice. I am sorry for my improper patches.
I will only report bugs instead of sending improper patches when I have 
no good solution of fixing the bugs.

Thanks,
Jia-Ju Bai

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web