From: Tomas Winkler <tomas.winkler@intel.com> To: Miquel Raynal <miquel.raynal@bootlin.com>, Richard Weinberger <richard@nod.at>, Vignesh Raghavendra <vigneshr@ti.com>, Jani Nikula <jani.nikula@linux.intel.com>, Joonas Lahtinen <joonas.lahtinen@linux.intel.com>, Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: linux-mtd@lists.infradead.org, intel-gfx@lists.freedesktop.org, Tomas Winkler <tomas.winkler@intel.com>, Alexander Usyskin <alexander.usyskin@intel.com>, Vitaly Lubart <vitaly.lubart@intel.com> Subject: [RFC PATCH 9/9] mtd: use refcount to prevent corruption Date: Tue, 16 Feb 2021 20:19:25 +0200 [thread overview] Message-ID: <20210216181925.650082-10-tomas.winkler@intel.com> (raw) In-Reply-To: <20210216181925.650082-1-tomas.winkler@intel.com> When underlying device is removed mtd core will crash in case user space is holding open handle. Need to use proper refcounting so device is release only when has no users. Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> --- drivers/mtd/mtdcore.c | 63 +++++++++++++++++++++++++---------------- drivers/mtd/mtdcore.h | 1 + drivers/mtd/mtdpart.c | 13 +++++---- include/linux/mtd/mtd.h | 2 +- 4 files changed, 47 insertions(+), 32 deletions(-) diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c index 2d6423d89a17..a3dacc7104a9 100644 --- a/drivers/mtd/mtdcore.c +++ b/drivers/mtd/mtdcore.c @@ -93,9 +93,31 @@ static void mtd_release(struct device *dev) dev_t index = MTD_DEVT(mtd->index); /* remove /dev/mtdXro node */ + if (mtd_is_partition(mtd)) + release_mtd_partition(mtd); + device_destroy(&mtd_class, index + 1); } +static void mtd_device_release(struct kref *kref) +{ + struct mtd_info *mtd = container_of(kref, struct mtd_info, refcnt); + + pr_debug("%s %s\n", __func__, mtd->name); + + if (mtd->nvmem) { + nvmem_unregister(mtd->nvmem); + mtd->nvmem = NULL; + } + + idr_remove(&mtd_idr, mtd->index); + of_node_put(mtd_get_of_node(mtd)); + + device_unregister(&mtd->dev); + + module_put(THIS_MODULE); +} + static ssize_t mtd_type_show(struct device *dev, struct device_attribute *attr, char *buf) { @@ -619,7 +641,7 @@ int add_mtd_device(struct mtd_info *mtd) } mtd->index = i; - mtd->usecount = 0; + kref_init(&mtd->refcnt); /* default value if not set by driver */ if (mtd->bitflip_threshold == 0) @@ -719,6 +741,8 @@ int del_mtd_device(struct mtd_info *mtd) int ret; struct mtd_notifier *not; + pr_debug("%s %s\n", __func__, mtd->name); + mutex_lock(&mtd_table_mutex); debugfs_remove_recursive(mtd->dbg.dfs_dir); @@ -733,23 +757,8 @@ int del_mtd_device(struct mtd_info *mtd) list_for_each_entry(not, &mtd_notifiers, list) not->remove(mtd); - if (mtd->usecount) { - printk(KERN_NOTICE "Removing MTD device #%d (%s) with use count %d\n", - mtd->index, mtd->name, mtd->usecount); - ret = -EBUSY; - } else { - /* Try to remove the NVMEM provider */ - if (mtd->nvmem) - nvmem_unregister(mtd->nvmem); - - device_unregister(&mtd->dev); - - idr_remove(&mtd_idr, mtd->index); - of_node_put(mtd_get_of_node(mtd)); - - module_put(THIS_MODULE); - ret = 0; - } + kref_put(&mtd->refcnt, mtd_device_release); + ret = 0; out_error: mutex_unlock(&mtd_table_mutex); @@ -984,20 +993,23 @@ int __get_mtd_device(struct mtd_info *mtd) if (!try_module_get(master->owner)) return -ENODEV; + kref_get(&mtd->refcnt); + pr_debug("get mtd %s %d\n", mtd->name, kref_read(&mtd->refcnt)); + if (master->_get_device) { err = master->_get_device(mtd); if (err) { + kref_put(&mtd->refcnt, mtd_device_release); module_put(master->owner); return err; } } - master->usecount++; - while (mtd->parent) { - mtd->usecount++; mtd = mtd->parent; + kref_get(&mtd->refcnt); + pr_debug("get mtd %s %d\n", mtd->name, kref_read(&mtd->refcnt)); } return 0; @@ -1055,14 +1067,15 @@ void __put_mtd_device(struct mtd_info *mtd) { struct mtd_info *master = mtd_get_master(mtd); + kref_put(&mtd->refcnt, mtd_device_release); + pr_debug("put mtd %s %d\n", mtd->name, kref_read(&mtd->refcnt)); + while (mtd->parent) { - --mtd->usecount; - BUG_ON(mtd->usecount < 0); mtd = mtd->parent; + kref_put(&mtd->refcnt, mtd_device_release); + pr_debug("put mtd %s %d\n", mtd->name, kref_read(&mtd->refcnt)); } - master->usecount--; - if (master->_put_device) master->_put_device(master); diff --git a/drivers/mtd/mtdcore.h b/drivers/mtd/mtdcore.h index b5eefeabf310..b014861a06a6 100644 --- a/drivers/mtd/mtdcore.h +++ b/drivers/mtd/mtdcore.h @@ -12,6 +12,7 @@ int __must_check add_mtd_device(struct mtd_info *mtd); int del_mtd_device(struct mtd_info *mtd); int add_mtd_partitions(struct mtd_info *, const struct mtd_partition *, int); int del_mtd_partitions(struct mtd_info *); +void release_mtd_partition(struct mtd_info *mtd); struct mtd_partitions; diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c index 12ca4f19cb14..6d70b5d0e663 100644 --- a/drivers/mtd/mtdpart.c +++ b/drivers/mtd/mtdpart.c @@ -27,10 +27,17 @@ static inline void free_partition(struct mtd_info *mtd) { + pr_err("free_partition \"%s\"\n", mtd->name); kfree(mtd->name); kfree(mtd); } +void release_mtd_partition(struct mtd_info *mtd) +{ + list_del_init(&mtd->part.node); + free_partition(mtd); +} + static struct mtd_info *allocate_partition(struct mtd_info *parent, const struct mtd_partition *part, int partno, uint64_t cur_offset) @@ -313,9 +320,6 @@ static int __mtd_del_partition(struct mtd_info *mtd) if (err) return err; - list_del(&child->part.node); - free_partition(mtd); - return 0; } @@ -341,9 +345,6 @@ static int __del_mtd_partitions(struct mtd_info *mtd) err = ret; continue; } - - list_del(&child->part.node); - free_partition(child); } return err; diff --git a/include/linux/mtd/mtd.h b/include/linux/mtd/mtd.h index 157357ec1441..1217c9d8d69d 100644 --- a/include/linux/mtd/mtd.h +++ b/include/linux/mtd/mtd.h @@ -373,7 +373,7 @@ struct mtd_info { struct module *owner; struct device dev; - int usecount; + struct kref refcnt; struct mtd_debug_info dbg; struct nvmem_device *nvmem; -- 2.26.2 ______________________________________________________ Linux MTD discussion mailing list http://lists.infradead.org/mailman/listinfo/linux-mtd/
WARNING: multiple messages have this Message-ID (diff)
From: Tomas Winkler <tomas.winkler@intel.com> To: Miquel Raynal <miquel.raynal@bootlin.com>, Richard Weinberger <richard@nod.at>, Vignesh Raghavendra <vigneshr@ti.com>, Jani Nikula <jani.nikula@linux.intel.com>, Joonas Lahtinen <joonas.lahtinen@linux.intel.com>, Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: linux-mtd@lists.infradead.org, intel-gfx@lists.freedesktop.org, Tomas Winkler <tomas.winkler@intel.com>, Alexander Usyskin <alexander.usyskin@intel.com>, Vitaly Lubart <vitaly.lubart@intel.com> Subject: [Intel-gfx] [RFC PATCH 9/9] mtd: use refcount to prevent corruption Date: Tue, 16 Feb 2021 20:19:25 +0200 [thread overview] Message-ID: <20210216181925.650082-10-tomas.winkler@intel.com> (raw) In-Reply-To: <20210216181925.650082-1-tomas.winkler@intel.com> When underlying device is removed mtd core will crash in case user space is holding open handle. Need to use proper refcounting so device is release only when has no users. Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> --- drivers/mtd/mtdcore.c | 63 +++++++++++++++++++++++++---------------- drivers/mtd/mtdcore.h | 1 + drivers/mtd/mtdpart.c | 13 +++++---- include/linux/mtd/mtd.h | 2 +- 4 files changed, 47 insertions(+), 32 deletions(-) diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c index 2d6423d89a17..a3dacc7104a9 100644 --- a/drivers/mtd/mtdcore.c +++ b/drivers/mtd/mtdcore.c @@ -93,9 +93,31 @@ static void mtd_release(struct device *dev) dev_t index = MTD_DEVT(mtd->index); /* remove /dev/mtdXro node */ + if (mtd_is_partition(mtd)) + release_mtd_partition(mtd); + device_destroy(&mtd_class, index + 1); } +static void mtd_device_release(struct kref *kref) +{ + struct mtd_info *mtd = container_of(kref, struct mtd_info, refcnt); + + pr_debug("%s %s\n", __func__, mtd->name); + + if (mtd->nvmem) { + nvmem_unregister(mtd->nvmem); + mtd->nvmem = NULL; + } + + idr_remove(&mtd_idr, mtd->index); + of_node_put(mtd_get_of_node(mtd)); + + device_unregister(&mtd->dev); + + module_put(THIS_MODULE); +} + static ssize_t mtd_type_show(struct device *dev, struct device_attribute *attr, char *buf) { @@ -619,7 +641,7 @@ int add_mtd_device(struct mtd_info *mtd) } mtd->index = i; - mtd->usecount = 0; + kref_init(&mtd->refcnt); /* default value if not set by driver */ if (mtd->bitflip_threshold == 0) @@ -719,6 +741,8 @@ int del_mtd_device(struct mtd_info *mtd) int ret; struct mtd_notifier *not; + pr_debug("%s %s\n", __func__, mtd->name); + mutex_lock(&mtd_table_mutex); debugfs_remove_recursive(mtd->dbg.dfs_dir); @@ -733,23 +757,8 @@ int del_mtd_device(struct mtd_info *mtd) list_for_each_entry(not, &mtd_notifiers, list) not->remove(mtd); - if (mtd->usecount) { - printk(KERN_NOTICE "Removing MTD device #%d (%s) with use count %d\n", - mtd->index, mtd->name, mtd->usecount); - ret = -EBUSY; - } else { - /* Try to remove the NVMEM provider */ - if (mtd->nvmem) - nvmem_unregister(mtd->nvmem); - - device_unregister(&mtd->dev); - - idr_remove(&mtd_idr, mtd->index); - of_node_put(mtd_get_of_node(mtd)); - - module_put(THIS_MODULE); - ret = 0; - } + kref_put(&mtd->refcnt, mtd_device_release); + ret = 0; out_error: mutex_unlock(&mtd_table_mutex); @@ -984,20 +993,23 @@ int __get_mtd_device(struct mtd_info *mtd) if (!try_module_get(master->owner)) return -ENODEV; + kref_get(&mtd->refcnt); + pr_debug("get mtd %s %d\n", mtd->name, kref_read(&mtd->refcnt)); + if (master->_get_device) { err = master->_get_device(mtd); if (err) { + kref_put(&mtd->refcnt, mtd_device_release); module_put(master->owner); return err; } } - master->usecount++; - while (mtd->parent) { - mtd->usecount++; mtd = mtd->parent; + kref_get(&mtd->refcnt); + pr_debug("get mtd %s %d\n", mtd->name, kref_read(&mtd->refcnt)); } return 0; @@ -1055,14 +1067,15 @@ void __put_mtd_device(struct mtd_info *mtd) { struct mtd_info *master = mtd_get_master(mtd); + kref_put(&mtd->refcnt, mtd_device_release); + pr_debug("put mtd %s %d\n", mtd->name, kref_read(&mtd->refcnt)); + while (mtd->parent) { - --mtd->usecount; - BUG_ON(mtd->usecount < 0); mtd = mtd->parent; + kref_put(&mtd->refcnt, mtd_device_release); + pr_debug("put mtd %s %d\n", mtd->name, kref_read(&mtd->refcnt)); } - master->usecount--; - if (master->_put_device) master->_put_device(master); diff --git a/drivers/mtd/mtdcore.h b/drivers/mtd/mtdcore.h index b5eefeabf310..b014861a06a6 100644 --- a/drivers/mtd/mtdcore.h +++ b/drivers/mtd/mtdcore.h @@ -12,6 +12,7 @@ int __must_check add_mtd_device(struct mtd_info *mtd); int del_mtd_device(struct mtd_info *mtd); int add_mtd_partitions(struct mtd_info *, const struct mtd_partition *, int); int del_mtd_partitions(struct mtd_info *); +void release_mtd_partition(struct mtd_info *mtd); struct mtd_partitions; diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c index 12ca4f19cb14..6d70b5d0e663 100644 --- a/drivers/mtd/mtdpart.c +++ b/drivers/mtd/mtdpart.c @@ -27,10 +27,17 @@ static inline void free_partition(struct mtd_info *mtd) { + pr_err("free_partition \"%s\"\n", mtd->name); kfree(mtd->name); kfree(mtd); } +void release_mtd_partition(struct mtd_info *mtd) +{ + list_del_init(&mtd->part.node); + free_partition(mtd); +} + static struct mtd_info *allocate_partition(struct mtd_info *parent, const struct mtd_partition *part, int partno, uint64_t cur_offset) @@ -313,9 +320,6 @@ static int __mtd_del_partition(struct mtd_info *mtd) if (err) return err; - list_del(&child->part.node); - free_partition(mtd); - return 0; } @@ -341,9 +345,6 @@ static int __del_mtd_partitions(struct mtd_info *mtd) err = ret; continue; } - - list_del(&child->part.node); - free_partition(child); } return err; diff --git a/include/linux/mtd/mtd.h b/include/linux/mtd/mtd.h index 157357ec1441..1217c9d8d69d 100644 --- a/include/linux/mtd/mtd.h +++ b/include/linux/mtd/mtd.h @@ -373,7 +373,7 @@ struct mtd_info { struct module *owner; struct device dev; - int usecount; + struct kref refcnt; struct mtd_debug_info dbg; struct nvmem_device *nvmem; -- 2.26.2 _______________________________________________ Intel-gfx mailing list Intel-gfx@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/intel-gfx
next prev parent reply other threads:[~2021-02-16 18:22 UTC|newest] Thread overview: 78+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-02-16 18:19 [RFC PATCH 0/9] drm/i915/spi: discrete graphics internal spi Tomas Winkler 2021-02-16 18:19 ` [Intel-gfx] " Tomas Winkler 2021-02-16 18:19 ` [RFC PATCH 1/9] drm/i915/spi: add spi device for discrete graphics Tomas Winkler 2021-02-16 18:19 ` [Intel-gfx] " Tomas Winkler 2021-02-17 10:42 ` Jani Nikula 2021-02-17 10:42 ` [Intel-gfx] " Jani Nikula 2021-02-17 17:14 ` Lucas De Marchi 2021-02-17 17:14 ` [Intel-gfx] " Lucas De Marchi 2021-02-17 19:02 ` Winkler, Tomas 2021-02-17 19:02 ` [Intel-gfx] " Winkler, Tomas 2021-02-16 18:19 ` [RFC PATCH 2/9] drm/i915/spi: intel_spi_region map Tomas Winkler 2021-02-16 18:19 ` [Intel-gfx] " Tomas Winkler 2021-02-17 10:46 ` Jani Nikula 2021-02-17 10:46 ` [Intel-gfx] " Jani Nikula 2021-02-17 20:45 ` Winkler, Tomas 2021-02-17 20:45 ` [Intel-gfx] " Winkler, Tomas 2021-02-22 10:17 ` Jani Nikula 2021-02-22 10:17 ` [Intel-gfx] " Jani Nikula 2021-02-22 11:30 ` Winkler, Tomas 2021-02-22 11:30 ` [Intel-gfx] " Winkler, Tomas 2021-02-16 18:19 ` [RFC PATCH 3/9] drm/i915/spi: add driver for on-die spi device Tomas Winkler 2021-02-16 18:19 ` [Intel-gfx] " Tomas Winkler 2021-02-17 10:56 ` Jani Nikula 2021-02-17 10:56 ` [Intel-gfx] " Jani Nikula 2021-02-17 20:58 ` Winkler, Tomas 2021-02-17 20:58 ` [Intel-gfx] " Winkler, Tomas 2021-02-18 9:49 ` Lucas De Marchi 2021-02-18 9:49 ` Lucas De Marchi 2021-02-18 10:50 ` Winkler, Tomas 2021-02-18 10:50 ` Winkler, Tomas 2021-02-19 6:06 ` Winkler, Tomas 2021-02-19 6:06 ` Winkler, Tomas 2021-02-19 22:59 ` Lucas De Marchi 2021-02-19 22:59 ` Lucas De Marchi 2021-02-20 17:56 ` Winkler, Tomas 2021-02-20 17:56 ` Winkler, Tomas 2021-02-16 18:19 ` [RFC PATCH 4/9] drm/i915/spi: implement region enumeration Tomas Winkler 2021-02-16 18:19 ` [Intel-gfx] " Tomas Winkler 2021-02-16 18:19 ` [RFC PATCH 5/9] drm/i915/spi: implement spi access functions Tomas Winkler 2021-02-16 18:19 ` [Intel-gfx] " Tomas Winkler 2021-02-16 18:19 ` [RFC PATCH 6/9] drm/i915/spi: spi register with mtd Tomas Winkler 2021-02-16 18:19 ` [Intel-gfx] " Tomas Winkler 2021-02-16 18:19 ` [RFC PATCH 7/9] drm/i915/spi: mtd: implement access handlers Tomas Winkler 2021-02-16 18:19 ` [Intel-gfx] " Tomas Winkler 2021-02-16 18:19 ` [RFC PATCH 8/9] drm/i915/spi: serialize spi access Tomas Winkler 2021-02-16 18:19 ` [Intel-gfx] " Tomas Winkler 2021-02-16 18:19 ` Tomas Winkler [this message] 2021-02-16 18:19 ` [Intel-gfx] [RFC PATCH 9/9] mtd: use refcount to prevent corruption Tomas Winkler 2021-02-16 18:45 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for drm/i915/spi: discrete graphics internal spi Patchwork 2021-02-16 18:47 ` [Intel-gfx] ✗ Fi.CI.SPARSE: " Patchwork 2021-02-16 19:14 ` [Intel-gfx] ✓ Fi.CI.BAT: success " Patchwork 2021-02-16 20:35 ` [Intel-gfx] ✗ Fi.CI.IGT: failure " Patchwork 2021-02-16 23:01 ` [RFC PATCH 0/9] " Richard Weinberger 2021-02-16 23:01 ` [Intel-gfx] " Richard Weinberger 2021-02-17 8:34 ` Winkler, Tomas 2021-02-17 8:34 ` [Intel-gfx] " Winkler, Tomas 2021-02-21 7:10 ` Winkler, Tomas 2021-02-21 7:10 ` [Intel-gfx] " Winkler, Tomas 2021-02-22 22:38 ` Richard Weinberger 2021-02-22 22:38 ` [Intel-gfx] " Richard Weinberger 2021-02-23 6:31 ` Winkler, Tomas 2021-02-23 6:31 ` [Intel-gfx] " Winkler, Tomas 2021-02-28 6:52 ` Winkler, Tomas 2021-02-28 6:52 ` [Intel-gfx] " Winkler, Tomas 2021-02-17 10:36 ` Jani Nikula 2021-02-17 10:36 ` [Intel-gfx] " Jani Nikula 2021-02-17 12:50 ` Winkler, Tomas 2021-02-17 12:50 ` [Intel-gfx] " Winkler, Tomas 2021-02-17 13:35 ` Jani Nikula 2021-02-17 13:35 ` [Intel-gfx] " Jani Nikula 2021-02-17 18:33 ` Rodrigo Vivi 2021-02-17 18:33 ` Rodrigo Vivi 2021-02-17 11:02 ` Jani Nikula 2021-02-17 11:02 ` [Intel-gfx] " Jani Nikula 2021-02-17 13:56 ` Winkler, Tomas 2021-02-17 13:56 ` [Intel-gfx] " Winkler, Tomas 2021-03-01 12:33 ` Jani Nikula 2021-03-01 12:33 ` [Intel-gfx] " Jani Nikula
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210216181925.650082-10-tomas.winkler@intel.com \ --to=tomas.winkler@intel.com \ --cc=alexander.usyskin@intel.com \ --cc=intel-gfx@lists.freedesktop.org \ --cc=jani.nikula@linux.intel.com \ --cc=joonas.lahtinen@linux.intel.com \ --cc=linux-mtd@lists.infradead.org \ --cc=miquel.raynal@bootlin.com \ --cc=richard@nod.at \ --cc=rodrigo.vivi@intel.com \ --cc=vigneshr@ti.com \ --cc=vitaly.lubart@intel.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.