From 705f385849b209605dadf0450effd96947fdb6c6 Mon Sep 17 00:00:00 2001 From: Jia-Ju Bai Date: Tue, 12 Dec 2017 21:08:06 +0800 Subject: [PATCH] rtl8188eu: Fix a possible sleep-in-atomic bug in set_tx_beacon_cmd The driver may sleep under a spinlock. The function call path is: update_beacon (acquire the spinlock) update_BCNTIM set_tx_beacon_cmd kzalloc(GFP_KERNEL) --> may sleep kmemdup(GFP_KERNEL) --> may sleep To fix it, GFP_KERNEL is replaced with GFP_ATOMIC. This bug is found by my static analysis tool(DSAC) and checked by my code review. Signed-off-by: Jia-Ju Bai Signed-off-by: Greg Kroah-Hartman --- drivers/staging/rtl8188eu/core/rtw_mlme_ext.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c b/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c index d73e9bdc80cc..bcb6919bb7d5 100644 --- a/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c +++ b/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c @@ -5395,14 +5395,14 @@ u8 set_tx_beacon_cmd(struct adapter *padapter) int len_diff = 0; - ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL); + ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC); if (!ph2c) { res = _FAIL; goto exit; } ptxBeacon_parm = kmemdup(&(pmlmeinfo->network), - sizeof(struct wlan_bssid_ex), GFP_KERNEL); + sizeof(struct wlan_bssid_ex), GFP_ATOMIC); if (ptxBeacon_parm == NULL) { kfree(ph2c); res = _FAIL; -- 2.45.2