diff options
| author | Jia-Ju Bai <baijiaju1990@gmail.com> | 2019-12-19 16:14:59 +0300 |
|---|---|---|
| committer | Linus Walleij <linus.walleij@linaro.org> | 2020-01-07 15:37:10 +0300 |
| commit | 25d071b3f6dbe4c4b9c9d0df76fbe9292310e799 (patch) | |
| tree | 27a55d211d6f1d5099a2d7de609f002223247d18 /drivers/gpio/gpio-grgpio.c | |
| parent | 048ae7e8b5dbee053b208fd93d68bc2125fed03c (diff) | |
| download | linux-25d071b3f6dbe4c4b9c9d0df76fbe9292310e799.tar.xz | |
gpio: gpio-grgpio: fix possible sleep-in-atomic-context bugs in grgpio_remove()
drivers/gpio/gpiolib-sysfs.c, 796:
mutex_lock in gpiochip_sysfs_unregister
drivers/gpio/gpiolib.c, 1455:
gpiochip_sysfs_unregister in gpiochip_remove
drivers/gpio/gpio-grgpio.c, 460:
gpiochip_remove in grgpio_remove
drivers/gpio/gpio-grgpio.c, 449:
_raw_spin_lock_irqsave in grgpio_remove
kernel/irq/irqdomain.c, 243:
mutex_lock in irq_domain_remove
drivers/gpio/gpio-grgpio.c, 463:
irq_domain_remove in grgpio_remove
drivers/gpio/gpio-grgpio.c, 449:
_raw_spin_lock_irqsave in grgpio_remove
mutex_lock() can sleep at runtime.
To fix these bugs, the lock is dropped in grgpio_remove(), because there
is no need for locking in remove() callbacks.
These bugs are found by a static analysis tool STCheck written by
myself.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Link: https://lore.kernel.org/r/20191219131459.18640-1-baijiaju1990@gmail.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Diffstat (limited to 'drivers/gpio/gpio-grgpio.c')
| -rw-r--r-- | drivers/gpio/gpio-grgpio.c | 4 |
1 files changed, 0 insertions, 4 deletions
diff --git a/drivers/gpio/gpio-grgpio.c b/drivers/gpio/gpio-grgpio.c index 08234e64993a..a49f0711ca94 100644 --- a/drivers/gpio/gpio-grgpio.c +++ b/drivers/gpio/gpio-grgpio.c @@ -437,8 +437,6 @@ static int grgpio_remove(struct platform_device *ofdev) int i; int ret = 0; - spin_lock_irqsave(&priv->gc.bgpio_lock, flags); - if (priv->domain) { for (i = 0; i < GRGPIO_MAX_NGPIO; i++) { if (priv->uirqs[i].refcnt != 0) { @@ -454,8 +452,6 @@ static int grgpio_remove(struct platform_device *ofdev) irq_domain_remove(priv->domain); out: - spin_unlock_irqrestore(&priv->gc.bgpio_lock, flags); - return ret; } |