This is a note to let you know that I've just added the patch titled

hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close

to the 3.18-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git%3Ba=su...

The filename of the patch is: hippi-fix-a-fix-a-possible-sleep-in-atomic-bug-in-rr_close.patch and it can be found in the queue-3.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let stable@vger.kernel.org know about it.

From foo@baz Fri Feb 23 12:01:27 CET 2018

From: Jia-Ju Bai baijiaju1990@163.com Date: Tue, 12 Dec 2017 16:49:52 +0800 Subject: hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close

From: Jia-Ju Bai baijiaju1990@163.com

[ Upstream commit 6e266610eb6553cfb7e7eb5d11914bd01509c406 ]

The driver may sleep under a spinlock. The function call path is: rr_close (acquire the spinlock) free_irq --> may sleep

To fix it, free_irq is moved to the place without holding the spinlock.

This bug is found by my static analysis tool(DSAC) and checked by my code review.

Signed-off-by: Jia-Ju Bai baijiaju1990@163.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin alexander.levin@microsoft.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/net/hippi/rrunner.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/hippi/rrunner.c +++ b/drivers/net/hippi/rrunner.c @@ -1381,8 +1381,8 @@ static int rr_close(struct net_device *d rrpriv->info_dma); rrpriv->info = NULL;

- free_irq(pdev->irq, dev); spin_unlock_irqrestore(&rrpriv->lock, flags); + free_irq(pdev->irq, dev);

return 0; }

Patches currently in stable-queue which might be from baijiaju1990@163.com are

queue-3.18/hippi-fix-a-fix-a-possible-sleep-in-atomic-bug-in-rr_close.patch