From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1755377AbcHSNYy (ORCPT <rfc822;w@1wt.eu>);
        Fri, 19 Aug 2016 09:24:54 -0400
Received: from smtp-proxy002.phy.lolipop.jp ([157.7.104.43]:39163 "EHLO
        smtp-proxy002.phy.lolipop.jp" rhost-flags-OK-OK-OK-OK)
        by vger.kernel.org with ESMTP id S1755247AbcHSNYx (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Fri, 19 Aug 2016 09:24:53 -0400
Subject: Re: Use of copy_to_user in fireworks_hwdep.c while holding a
 spin_lock
To: Vaishali Thakkar <vaishali.thakkar@oracle.com>,
        Clemens Ladisch <clemens@ladisch.de>, Jaroslav Kysela <perex@perex.cz>,
        Takashi Iwai <tiwai@suse.com>, alsa-devel@alsa-project.org,
        linux-kernel@vger.kernel.org, Julia Lawall <julia.lawall@lip6.fr>
References: <57B6A61F.7080700@oracle.com>
From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Message-ID: <57B708A1.9010607@sakamocchi.jp>
Date: Fri, 19 Aug 2016 22:24:49 +0900
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101
 Thunderbird/38.6.0
MIME-Version: 1.0
In-Reply-To: <57B6A61F.7080700@oracle.com>
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi,

On Aug 19 2016 15:24, Vaishali Thakkar wrote:
> I was wondering about the call to copy_to_user in function hwdep_read_locked and
> hwdep_read_resp_buf for driver sound/firewire/fireworks/fireworks_hwdep.c. 
> The function hwdep_read calls both of these functions while holding a spinlock[1],
> which is not normally allowed due to the possibility of a deadlock.
> 
> This seems to be coming from the commit 555e8a8f7f149544eb7d4aa3a6420bc4c3055638
> while adding a command/response functionality into hwdep interface. Is there some
> reason that I am overlooking, why it is OK in this case? Is there some code in the
> same file which ensures that page fault will not occur when we are calling these
> functions while holding a spin_lock_irq?
> 
> The same issue is there with the driver sound/firewire/tascam/tascam-hwdep.c for
> obvious reasons.
> 
> Coccinelle script is used to detect this issue.
> 
> Thank you.
> 
> [1] http://lxr.free-electrons.com/source/sound/firewire/fireworks/fireworks_hwdep.c#L114

Indeed, I was unaware of the situation in which deadlock occurs; i.e.
page fault.

I'm on short summer vacation, so will post patches for them in next week.


Thanks

Takashi Sakamoto