[PATCH] mmc: vub300: fix sleeping function call from invalid context in vub300_inactivity_timer_expired
Jakov Novak <[email protected]>
| Newsgroups | org.kernel.vger.linux-mmc,dev.linux.lists.linux-kernel-mentees,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
Currently, the function vub300_inactivity_timer_expired, which gets
called in a softirq context, calls a sleeping function in the following
call chain:
vub300_inactivity_timer_expired -> kref_put -> vub300_delete ->
mmc_free_host -> cancel_delayed_work_sync -> __cancel_work_sync ->
might_sleep -> BUG
Fix this by replacing kref_put(&vub300->kref, vub300_delete) with
vub300_queue_dead_work(vub300), which does the same thing, but in a
workqueue context.
Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver")
Reported-and-tested-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=1ee4f3b9228e35f14677
Signed-off-by: Jakov Novak <[email protected]>
---
drivers/mmc/host/vub300.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c
index 2dae474dcd06..df0096bc53db 100644
--- a/drivers/mmc/host/vub300.c
+++ b/drivers/mmc/host/vub300.c
@@ -744,7 +744,7 @@ static void vub300_inactivity_timer_expired(struct timer_list *t)
struct vub300_mmc_host *vub300 = timer_container_of(vub300, t,
inactivity_timer);
if (!vub300->interface) {
- kref_put(&vub300->kref, vub300_delete);
+ vub300_queue_dead_work(vub300);
} else if (vub300->cmd) {
mod_timer(&vub300->inactivity_timer, jiffies + HZ);
} else {
--
2.55.0