diff options
| author | Chengfeng Ye <dg573847474@gmail.com> | 2023-12-07 13:34:53 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2023-12-09 22:17:45 +0100 |
| commit | 15319a4e8ee4b098118591c6ccbd17237f841613 (patch) | |
| tree | 367efa884182102f12cf52c46e093ff62db23fa8 /drivers/atm | |
| parent | atm: solos-pci: Fix potential deadlock on &cli_queue_lock (diff) | |
| download | linux-15319a4e8ee4b098118591c6ccbd17237f841613.tar.xz linux-15319a4e8ee4b098118591c6ccbd17237f841613.zip | |
atm: solos-pci: Fix potential deadlock on &tx_queue_lock
As &card->tx_queue_lock is acquired under softirq context along the
following call chain from solos_bh(), other acquisition of the same
lock inside process context should disable at least bh to avoid double
lock.
<deadlock #2>
pclose()
--> spin_lock(&card->tx_queue_lock)
<interrupt>
--> solos_bh()
--> fpga_tx()
--> spin_lock(&card->tx_queue_lock)
This flaw was found by an experimental static analysis tool I am
developing for irq-related deadlock.
To prevent the potential deadlock, the patch uses spin_lock_bh()
on &card->tx_queue_lock under process context code consistently to
prevent the possible deadlock scenario.
Fixes: 213e85d38912 ("solos-pci: clean up pclose() function")
Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/atm')
| -rw-r--r-- | drivers/atm/solos-pci.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c index 95f768b28a5e..d3c30a28c410 100644 --- a/drivers/atm/solos-pci.c +++ b/drivers/atm/solos-pci.c @@ -956,14 +956,14 @@ static void pclose(struct atm_vcc *vcc) struct pkt_hdr *header; /* Remove any yet-to-be-transmitted packets from the pending queue */ - spin_lock(&card->tx_queue_lock); + spin_lock_bh(&card->tx_queue_lock); skb_queue_walk_safe(&card->tx_queue[port], skb, tmpskb) { if (SKB_CB(skb)->vcc == vcc) { skb_unlink(skb, &card->tx_queue[port]); solos_pop(vcc, skb); } } - spin_unlock(&card->tx_queue_lock); + spin_unlock_bh(&card->tx_queue_lock); skb = alloc_skb(sizeof(*header), GFP_KERNEL); if (!skb) { |