Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1774250a authored by Chengfeng Ye's avatar Chengfeng Ye Committed by Greg Kroah-Hartman
Browse files

mISDN: hfcpci: Fix potential deadlock on &hc->lock 



[ Upstream commit 56c6be35fcbed54279df0a2c9e60480a61841d6f ]

As &hc->lock is acquired by both timer _hfcpci_softirq() and hardirq
hfcpci_int(), the timer should disable irq before lock acquisition
otherwise deadlock could happen if the timmer is preemtped by the hadr irq.

Possible deadlock scenario:
hfcpci_softirq() (timer)
    -> _hfcpci_softirq()
    -> spin_lock(&hc->lock);
        <irq interruption>
        -> hfcpci_int()
        -> spin_lock(&hc->lock); (deadlock here)

This flaw was found by an experimental static analysis tool I am developing
for irq-related deadlock.

The tentative patch fixes the potential deadlock by spin_lock_irq()
in timer.

Fixes: b36b654a ("mISDN: Create /sys/class/mISDN")
Signed-off-by: default avatarChengfeng Ye <dg573847474@gmail.com>
Link: https://lore.kernel.org/r/20230727085619.7419-1-dg573847474@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 42b28808

drivers/isdn/hardware/mISDN/hfcpci.c

+5 −5
Original line number Diff line number Diff line
@@ -839,7 +839,7 @@ hfcpci_fill_fifo(struct bchannel *bch) 
		*z1t = cpu_to_le16(new_z1);	/* now send data */

		if (bch->tx_idx < bch->tx_skb->len)

			return;

		dev_kfree_skb(bch->tx_skb);

		dev_kfree_skb_any(bch->tx_skb);

		if (get_next_bframe(bch))

			goto next_t_frame;

		return;
@@ -895,7 +895,7 @@ hfcpci_fill_fifo(struct bchannel *bch) 
	}

	bz->za[new_f1].z1 = cpu_to_le16(new_z1);	/* for next buffer */

	bz->f1 = new_f1;	/* next frame */

	dev_kfree_skb(bch->tx_skb);

	dev_kfree_skb_any(bch->tx_skb);

	get_next_bframe(bch);

}
@@ -1119,7 +1119,7 @@ tx_birq(struct bchannel *bch) 
	if (bch->tx_skb && bch->tx_idx < bch->tx_skb->len)

		hfcpci_fill_fifo(bch);

	else {

		dev_kfree_skb(bch->tx_skb);

		dev_kfree_skb_any(bch->tx_skb);

		if (get_next_bframe(bch))

			hfcpci_fill_fifo(bch);

	}
@@ -2272,7 +2272,7 @@ _hfcpci_softirq(struct device *dev, void *unused) 
		return 0;



	if (hc->hw.int_m2 & HFCPCI_IRQ_ENABLE) {

		spin_lock(&hc->lock);

		spin_lock_irq(&hc->lock);

		bch = Sel_BCS(hc, hc->hw.bswapped ? 2 : 1);

		if (bch && bch->state == ISDN_P_B_RAW) { /* B1 rx&tx */

			main_rec_hfcpci(bch);
@@ -2283,7 +2283,7 @@ _hfcpci_softirq(struct device *dev, void *unused) 
			main_rec_hfcpci(bch);

			tx_birq(bch);

		}

		spin_unlock(&hc->lock);

		spin_unlock_irq(&hc->lock);

	}

	return 0;

}