History

staging: r8188eu: Fix scheduling while atomic error introduced in commit fadbe0cd

In commit fadbe0cd5292851608e2e01b91d9295fa287b9fe entitled "staging: rtl8188eu:Remove rtw_zmalloc(), wrapper for kzalloc()", the author failed to note that the original code in the wrapper tested whether the caller could sleep, and set the flags argument to kzalloc() appropriately. After the patch, GFP_KERNEL is used unconditionally. Unfortunately, several of the routines may be entered from an interrupt routine and generate a BUG splat for every such call. Routine rtw_sitesurvey_cmd() is used in the example below: BUG: sleeping function called from invalid context at mm/slub.c:1240 in_atomic(): 1, irqs_disabled(): 0, pid: 756, name: wpa_supplicant INFO: lockdep is turned off. CPU: 2 PID: 756 Comm: wpa_supplicant Tainted: G WC O 3.18.0-rc4+ #34 Hardware name: TOSHIBA TECRA A50-A/TECRA A50-A, BIOS Version 4.20 04/17/2014 ffffc90005557000 ffff880216fafaa8 ffffffff816b0bbf 0000000000000000 ffff8800c3b58000 ffff880216fafac8 ffffffff8107af77 0000000000000001 0000000000000010 ffff880216fafb18 ffffffff811b06ce 0000000000000000 Call Trace: [<ffffffff816b0bbf>] dump_stack+0x4e/0x71 [<ffffffff8107af77>] __might_sleep+0xf7/0x120 [<ffffffff811b06ce>] kmem_cache_alloc_trace+0x4e/0x1f0 [<ffffffffa0888226>] ? rtw_sitesurvey_cmd+0x56/0x2a0 [r8188eu] [<ffffffffa0888226>] rtw_sitesurvey_cmd+0x56/0x2a0 [r8188eu] [<ffffffffa088f00d>] rtw_do_join+0x22d/0x370 [r8188eu] [<ffffffffa088f6e8>] rtw_set_802_11_ssid+0x218/0x3d0 [r8188eu] [<ffffffffa08c3ca5>] rtw_wx_set_essid+0x1e5/0x410 [r8188eu] [<ffffffffa08c3ac0>] ? rtw_wx_get_rate+0x50/0x50 [r8188eu] [<ffffffff816938f1>] ioctl_standard_iw_point+0x151/0x3f0 [<ffffffff81693d52>] ioctl_standard_call+0xb2/0xe0 [<ffffffff81597df7>] ? rtnl_lock+0x17/0x20 [<ffffffff816945a0>] ? iw_handler_get_private+0x70/0x70 [<ffffffff81693ca0>] ? call_commit_handler+0x40/0x40 [<ffffffff81693256>] wireless_process_ioctl+0x176/0x1c0 [<ffffffff81693e79>] wext_handle_ioctl+0x69/0xc0 [<ffffffff8159fe79>] dev_ioctl+0x309/0x5e0 [<ffffffff810be9c7>] ? call_rcu+0x17/0x20 [<ffffffff8156a472>] sock_ioctl+0x142/0x2e0 [<ffffffff811e0c70>] do_vfs_ioctl+0x300/0x520 [<ffffffff81101514>] ? __audit_syscall_entry+0xb4/0x110 [<ffffffff81101514>] ? __audit_syscall_entry+0xb4/0x110 [<ffffffff810102bc>] ? do_audit_syscall_entry+0x6c/0x70 [<ffffffff811e0f11>] SyS_ioctl+0x81/0xa0 [<ffffffff816ba1d2>] system_call_fastpath+0x12/0x17 Additional routines that generate this BUG are rtw_joinbss_cmd(), rtw_dynamic_chk_wk_cmd(), rtw_lps_ctrl_wk_cmd(), rtw_rpt_timer_cfg_cmd(), rtw_ps_cmd(), report_survey_event(), report_join_res(), survey_timer_hdl(), and rtw_check_bcn_info().

Larry Finger committed 12 years ago

Commit 33dc85c1 parent 8bb9b9a3 files · +18 −18Browse files

Unified · Split

3 files
  1. drivers/staging/rtl8188eu/core/rtw_cmd.c +11 −11
  2. drivers/staging/rtl8188eu/core/rtw_mlme_ext.c +6 −6
  3. drivers/staging/rtl8188eu/core/rtw_wlan_util.c +1 −1
drivers/staging/rtl8188eu/core/rtw_cmd.c+11−11
@@ -275,11 +275,11 @@ u8 rtw_sitesurvey_cmd(struct adapter *padapter, struct ndis_802_11_ssid *ssid, · 274 unmodified lines
275275 if (check_fwstate(pmlmepriv, _FW_LINKED) == true)
276276 rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_SCAN, 1);
277277
278− ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
278+ ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
279279 if (ph2c == NULL)
280280 return _FAIL;
281281
282− psurveyPara = kzalloc(sizeof(struct sitesurvey_parm), GFP_KERNEL);
282+ psurveyPara = kzalloc(sizeof(struct sitesurvey_parm), GFP_ATOMIC);
283283 if (psurveyPara == NULL) {
284284 kfree(ph2c);
285285 return _FAIL;
@@ -405,7 +405,7 @@ u8 rtw_joinbss_cmd(struct adapter *padapter, struct wlan_network *pnetwork) · 119 unmodified lines
405405 else
406406 RT_TRACE(_module_rtl871x_cmd_c_, _drv_notice_, ("+Join cmd: SSid =[%s]\n", pmlmepriv->assoc_ssid.Ssid));
407407
408− pcmd = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
408+ pcmd = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
409409 if (pcmd == NULL) {
410410 res = _FAIL;
411411 RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_, ("rtw_joinbss_cmd: memory allocate for cmd_obj fail!!!\n"));
@@ -755,13 +755,13 @@ u8 rtw_dynamic_chk_wk_cmd(struct adapter *padapter) · 343 unmodified lines
755755 u8 res = _SUCCESS;
756756
757757
758− ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
758+ ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
759759 if (ph2c == NULL) {
760760 res = _FAIL;
761761 goto exit;
762762 }
763763
764− pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm), GFP_KERNEL);
764+ pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm), GFP_ATOMIC);
765765 if (pdrvextra_cmd_parm == NULL) {
766766 kfree(ph2c);
767767 res = _FAIL;
@@ -967,13 +967,13 @@ u8 rtw_lps_ctrl_wk_cmd(struct adapter *padapter, u8 lps_ctrl_type, u8 enqueue) · 199 unmodified lines
967967 u8 res = _SUCCESS;
968968
969969 if (enqueue) {
970− ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
970+ ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
971971 if (ph2c == NULL) {
972972 res = _FAIL;
973973 goto exit;
974974 }
975975
976− pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm), GFP_KERNEL);
976+ pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm), GFP_ATOMIC);
977977 if (pdrvextra_cmd_parm == NULL) {
978978 kfree(ph2c);
979979 res = _FAIL;
@@ -1010,13 +1010,13 @@ u8 rtw_rpt_timer_cfg_cmd(struct adapter *padapter, u16 min_time) · 30 unmodified lines
10101010
10111011 u8 res = _SUCCESS;
10121012
1013− ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
1013+ ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
10141014 if (ph2c == NULL) {
10151015 res = _FAIL;
10161016 goto exit;
10171017 }
10181018
1019− pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm), GFP_KERNEL);
1019+ pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm), GFP_ATOMIC);
10201020 if (pdrvextra_cmd_parm == NULL) {
10211021 kfree(ph2c);
10221022 res = _FAIL;
@@ -1088,13 +1088,13 @@ u8 rtw_ps_cmd(struct adapter *padapter) · 65 unmodified lines
10881088
10891089 u8 res = _SUCCESS;
10901090
1091− ppscmd = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
1091+ ppscmd = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
10921092 if (ppscmd == NULL) {
10931093 res = _FAIL;
10941094 goto exit;
10951095 }
10961096
1097− pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm), GFP_KERNEL);
1097+ pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm), GFP_ATOMIC);
10981098 if (pdrvextra_cmd_parm == NULL) {
10991099 kfree(ppscmd);
11001100 res = _FAIL;
drivers/staging/rtl8188eu/core/rtw_mlme_ext.c+6−6
@@ -4241,12 +4241,12 @@ void report_survey_event(struct adapter *padapter, · 4240 unmodified lines
42414241 pcmdpriv = &padapter->cmdpriv;
42424242
42434243
4244− pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
4244+ pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
42454245 if (pcmd_obj == NULL)
42464246 return;
42474247
42484248 cmdsz = (sizeof(struct survey_event) + sizeof(struct C2HEvent_Header));
4249− pevtcmd = kzalloc(cmdsz, GFP_KERNEL);
4249+ pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);
42504250 if (pevtcmd == NULL) {
42514251 kfree(pcmd_obj);
42524252 return;
@@ -4339,12 +4339,12 @@ void report_join_res(struct adapter *padapter, int res) · 86 unmodified lines
43394339 struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
43404340 struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
43414341
4342− pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
4342+ pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
43434343 if (pcmd_obj == NULL)
43444344 return;
43454345
43464346 cmdsz = (sizeof(struct joinbss_event) + sizeof(struct C2HEvent_Header));
4347− pevtcmd = kzalloc(cmdsz, GFP_KERNEL);
4347+ pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);
43484348 if (pevtcmd == NULL) {
43494349 kfree(pcmd_obj);
43504350 return;
@@ -4854,11 +4854,11 @@ void survey_timer_hdl(void *function_context) · 503 unmodified lines
48544854 pmlmeext->scan_abort = false;/* reset */
48554855 }
48564856
4857− ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
4857+ ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
48584858 if (ph2c == NULL)
48594859 goto exit_survey_timer_hdl;
48604860
4861− psurveyPara = kzalloc(sizeof(struct sitesurvey_parm), GFP_KERNEL);
4861+ psurveyPara = kzalloc(sizeof(struct sitesurvey_parm), GFP_ATOMIC);
48624862 if (psurveyPara == NULL) {
48634863 kfree(ph2c);
48644864 goto exit_survey_timer_hdl;
drivers/staging/rtl8188eu/core/rtw_wlan_util.c+1−1
@@ -935,7 +935,7 @@ int rtw_check_bcn_info(struct adapter *Adapter, u8 *pframe, u32 packet_len) · 934 unmodified lines
935935 return true;
936936 }
937937
938− bssid = kzalloc(sizeof(struct wlan_bssid_ex), GFP_KERNEL);
938+ bssid = kzalloc(sizeof(struct wlan_bssid_ex), GFP_ATOMIC);
939939
940940 subtype = GetFrameSubType(pframe) >> 4;
941941

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t