diff options
author | Jia-Ju Bai <baijiaju1990@gmail.com> | 2017-12-13 04:28:04 -0500 |
---|---|---|
committer | Marcel Holtmann <marcel@holtmann.org> | 2017-12-13 08:38:59 -0500 |
commit | 479f335c1b24b98fd1daae024d2f5d7cc355f1fc (patch) | |
tree | 981933b5f8e6358676474d23eaf906339a81e60b | |
parent | 9e1e9f20ca96026c56ac613317ea4bf01c6c3385 (diff) |
Bluetooth: Fix a possible sleep-in-atomic bug in bluecard_write_wakeup
The driver may sleep in the interrupt handler.
The function call path is:
bluecard_interrupt (interrupt handler)
bluecard_write_wakeup
schedule_timeout --> may sleep
To fix it, schedule_timeout is replaced with mdelay.
This bug is found by my static analysis tool(DSAC) and checked by my code review.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
-rw-r--r-- | drivers/bluetooth/bluecard_cs.c | 8 |
1 files changed, 2 insertions, 6 deletions
diff --git a/drivers/bluetooth/bluecard_cs.c b/drivers/bluetooth/bluecard_cs.c index d513ef4743dc..82437a69f99c 100644 --- a/drivers/bluetooth/bluecard_cs.c +++ b/drivers/bluetooth/bluecard_cs.c | |||
@@ -302,9 +302,7 @@ static void bluecard_write_wakeup(struct bluecard_info *info) | |||
302 | } | 302 | } |
303 | 303 | ||
304 | /* Wait until the command reaches the baseband */ | 304 | /* Wait until the command reaches the baseband */ |
305 | prepare_to_wait(&wq, &wait, TASK_INTERRUPTIBLE); | 305 | mdelay(100); |
306 | schedule_timeout(HZ/10); | ||
307 | finish_wait(&wq, &wait); | ||
308 | 306 | ||
309 | /* Set baud on baseband */ | 307 | /* Set baud on baseband */ |
310 | info->ctrl_reg &= ~0x03; | 308 | info->ctrl_reg &= ~0x03; |
@@ -316,9 +314,7 @@ static void bluecard_write_wakeup(struct bluecard_info *info) | |||
316 | outb(info->ctrl_reg, iobase + REG_CONTROL); | 314 | outb(info->ctrl_reg, iobase + REG_CONTROL); |
317 | 315 | ||
318 | /* Wait before the next HCI packet can be send */ | 316 | /* Wait before the next HCI packet can be send */ |
319 | prepare_to_wait(&wq, &wait, TASK_INTERRUPTIBLE); | 317 | mdelay(1000); |
320 | schedule_timeout(HZ); | ||
321 | finish_wait(&wq, &wait); | ||
322 | } | 318 | } |
323 | 319 | ||
324 | if (len == skb->len) { | 320 | if (len == skb->len) { |