From 2051c6ae928ddbd4d314ba8ea89298d686ad86b7 Mon Sep 17 00:00:00 2001 From: Jia-Ju Bai Date: Sat, 15 Sep 2018 10:57:11 +0800 Subject: [PATCH] staging: rtl8188eu: Fix a sleep-in-atomic-context bug in issue_deauth_ex() The driver may sleep with holding a spinlock. The function call path (from bottom to top) in Linux-4.17 is: [FUNC] msleep drivers/staging/rtl8188eu/core/rtw_mlme_ext.c, 1536: msleep in issue_deauth_ex drivers/staging/rtl8188eu/core/rtw_mlme_ext.c, 5110: issue_deauth_ex in disconnect_hdl drivers/staging/rtl8188eu/core/rtw_cmd.c, 521: disconnect_hdl in rtw_disassoc_cmd drivers/staging/rtl8188eu/core/rtw_ioctl_set.c, 352: rtw_disassoc_cmd in rtw_set_802_11_infrastructure_mode drivers/staging/rtl8188eu/os_dep/ioctl_linux.c, 1002: rtw_set_802_11_infrastructure_mode in rtw_wx_set_wap drivers/staging/rtl8188eu/os_dep/ioctl_linux.c, 988: spin_lock_bh in rtw_wx_set_wap To fix this bug, msleep() is replaced with mdelay(). This bug is found by my static analysis tool DSAC. Signed-off-by: Jia-Ju Bai Signed-off-by: Greg Kroah-Hartman --- drivers/staging/rtl8188eu/core/rtw_mlme_ext.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c b/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c index 213c8d670591..834053a0ae9d 100644 --- a/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c +++ b/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c @@ -1513,7 +1513,7 @@ static int issue_deauth_ex(struct adapter *padapter, u8 *da, break; if (i < try_cnt && wait_ms > 0 && ret == _FAIL) - msleep(wait_ms); + mdelay(wait_ms); } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0))); if (ret != _FAIL) { -- 2.45.2