linux_dsm_epyc7002/drivers/usb
Jia-Ju Bai 9c1ed62ae0 usb: gadget: udc: fix possible sleep-in-atomic-context bugs in gr_probe()
The driver may sleep while holding a spinlock.
The function call path (from bottom to top) in Linux 4.19 is:

drivers/usb/gadget/udc/core.c, 1175:
	kzalloc(GFP_KERNEL) in usb_add_gadget_udc_release
drivers/usb/gadget/udc/core.c, 1272:
	usb_add_gadget_udc_release in usb_add_gadget_udc
drivers/usb/gadget/udc/gr_udc.c, 2186:
	usb_add_gadget_udc in gr_probe
drivers/usb/gadget/udc/gr_udc.c, 2183:
	spin_lock in gr_probe

drivers/usb/gadget/udc/core.c, 1195:
	mutex_lock in usb_add_gadget_udc_release
drivers/usb/gadget/udc/core.c, 1272:
	usb_add_gadget_udc_release in usb_add_gadget_udc
drivers/usb/gadget/udc/gr_udc.c, 2186:
	usb_add_gadget_udc in gr_probe
drivers/usb/gadget/udc/gr_udc.c, 2183:
	spin_lock in gr_probe

drivers/usb/gadget/udc/gr_udc.c, 212:
	debugfs_create_file in gr_probe
drivers/usb/gadget/udc/gr_udc.c, 2197:
	gr_dfs_create in gr_probe
drivers/usb/gadget/udc/gr_udc.c, 2183:
    spin_lock in gr_probe

drivers/usb/gadget/udc/gr_udc.c, 2114:
	devm_request_threaded_irq in gr_request_irq
drivers/usb/gadget/udc/gr_udc.c, 2202:
	gr_request_irq in gr_probe
drivers/usb/gadget/udc/gr_udc.c, 2183:
    spin_lock in gr_probe

kzalloc(GFP_KERNEL), mutex_lock(), debugfs_create_file() and
devm_request_threaded_irq() can sleep at runtime.

To fix these possible bugs, usb_add_gadget_udc(), gr_dfs_create() and
gr_request_irq() are called without handling the spinlock.

These bugs are found by a static analysis tool STCheck written by myself.

Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-15 10:39:22 +01:00
..
atm USB driver fixes for 5.5-rc2 2019-12-14 12:40:39 -08:00
c67x00 USB: add SPDX identifiers to all remaining Makefiles 2017-11-07 15:53:48 +01:00
cdns3 Merge 5.5-rc6 into usb-next 2020-01-13 12:11:40 +01:00
chipidea Merge 5.5-rc6 into usb-next 2020-01-13 12:11:40 +01:00
class compat_ioctl: remove most of fs/compat_ioctl.c 2019-12-01 13:46:15 -08:00
common usb: common: usb-conn-gpio: Don't log an error on probe deferral 2019-12-10 11:41:20 +01:00
core usb: missing parentheses in USE_NEW_SCHEME 2020-01-08 17:44:11 +01:00
dwc2 usb: dwc2: fix debugfs FIFO count 2020-01-15 10:39:21 +01:00
dwc3 usb: dwc3: gadget: Clear DCTL.ULSTCHNGREQ before set 2020-01-15 10:39:20 +01:00
early drivers: Remove explicit invocations of mmiowb() 2019-04-08 12:01:02 +01:00
gadget usb: gadget: udc: fix possible sleep-in-atomic-context bugs in gr_probe() 2020-01-15 10:39:22 +01:00
host Merge 5.5-rc6 into usb-next 2020-01-13 12:11:40 +01:00
image Merge 5.4-rc3 into usb-next 2019-10-14 07:09:59 +02:00
isp1760 usb: isp1760: isp1760-hcd.c: Drop condition with no effect 2019-10-07 13:01:47 +02:00
misc usb: usb3503: Convert to use GPIO descriptors 2019-12-30 20:40:19 +01:00
mon usb: mon: Fix a deadlock in usbmon between mmap and read 2019-12-10 11:41:20 +01:00
mtu3 Merge 5.4-rc6 into usb-next 2019-11-04 06:41:09 +01:00
musb usb: musb: Disable pullup at init 2020-01-08 17:34:17 +01:00
phy usb: phy-generic: Delete unused platform data 2020-01-15 10:39:20 +01:00
renesas_usbhs usb: renesas_usbhs: Switch to GPIO descriptor 2019-12-30 20:37:42 +01:00
roles usb: roles: fix a potential use after free 2019-12-10 11:41:18 +01:00
serial Merge 5.5-rc6 into usb-next 2020-01-13 12:11:40 +01:00
storage USB: Fix incorrect DMA allocations for local memory pool drivers 2019-12-11 09:06:41 +01:00
typec Merge 5.5-rc6 into usb-next 2020-01-13 12:11:40 +01:00
usbip usbip: Fix error path of vhci_recv_ret_submit() 2019-12-17 16:36:33 +01:00
Kconfig usb: common: create Kconfig file 2019-09-03 19:00:39 +02:00
Makefile USB: Changes for v5.4 merge window 2019-09-02 19:20:57 +02:00
usb-skeleton.c USB: usb-skeleton: drop redundant in-urb check 2019-10-10 12:41:19 +02:00