[Home]

Issue of the Implementation # L0031

Brief

drivers/net/usb/catc.c: potential deadlock in catc_ctrl_run()

Detailed Description

catc_ctrl_run() calls usb_submit_urb() with GFP_KERNEL, while it is called from catc_ctrl_async() and catc_ctrl_done() with catc->ctrl_lock spinlock held.

Possible solutions

--- a/drivers/net/usb/catc.c
+++ b/drivers/net/usb/catc.c
@@ -495,7 +495,7 @@ static void catc_ctrl_run(struct catc *catc)
        if (!q->dir && q->buf && q->len)
                memcpy(catc->ctrl_buf, q->buf, q->len);
 
-       if ((status = usb_submit_urb(catc->ctrl_urb, GFP_KERNEL)))
+       if ((status = usb_submit_urb(catc->ctrl_urb, GFP_ATOMIC)))
                err("submit(ctrl_urb) status %d", status);
 }

Component

linux-kernel 2.6.39

Accepted

https://lkml.org/lkml/2011/5/31/504
commit

Status

Fixed in kernel 3.0-rc2

[Home]