From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,FAKE_REPLY_C,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8AC44C433DF for ; Thu, 16 Jul 2020 14:06:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 62B88207CB for ; Thu, 16 Jul 2020 14:06:16 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="S/y331CQ" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728891AbgGPOGP (ORCPT ); Thu, 16 Jul 2020 10:06:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44122 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728418AbgGPOGO (ORCPT ); Thu, 16 Jul 2020 10:06:14 -0400 Received: from mail-pg1-x543.google.com (mail-pg1-x543.google.com [IPv6:2607:f8b0:4864:20::543]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8204EC061755; Thu, 16 Jul 2020 07:06:14 -0700 (PDT) Received: by mail-pg1-x543.google.com with SMTP id e8so4910767pgc.5; Thu, 16 Jul 2020 07:06:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:date:from:to:cc:subject:message-id:mime-version :content-disposition:user-agent; bh=qp5LmKixJbTZrd7dvLLYaQtddHIpTsfAo6ECopZweXQ=; b=S/y331CQGpGTRoxMTS0W9OaxMezWmiauIc7qwm2Kk6e5FoHlxNUbnIG+jjxsPjKJ+o H9Icw1n2MsYTZL4Wx518YJHKh8qPkSosLXgYA3N1BNEdJW584p5o1EaGb1p78YCDEk+2 lUOX6xwBKTKXkTiUkB04uUQzRisvnEdLR2zpKNr16GoKkE/JPH/FBayOtvUXt8WI7uG0 EHxdQIqAYrUwpVeSye55o0QYL+ddKQqnYmC95e7/2NfCAJ0ngfw2S5Fe8Q358RVbWEbX eA+qMfL/YmT9ieF2GNxzN9rmfn0elmCg2TUQQ0yHToV+yZCt3h84CYKLH01ddM/t31s+ BF/Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:date:from:to:cc:subject:message-id :mime-version:content-disposition:user-agent; bh=qp5LmKixJbTZrd7dvLLYaQtddHIpTsfAo6ECopZweXQ=; b=d1MgJiexh7Ncz6xeavlCfiji46WbQf5uW5bUsAGSEZ9QqCU9mWFhR3qY2RzeNXuRXT U+HcgjwHyguzgEB6twfJ74tdDMisxq7yLm5lvk/RW0oxMyRTn7lT6nn8oO/T0r7xycBv wh5lqxBHZfAgF/17AR1fuZnnb6XJLbTxAojF2oOXVyTo0PVejnr7hNvBZ2p6wDIoWSn3 BAfnVBlbgzqHEPT+XWr54azpLoWul2ftOm9KdgNS3Yo8bEuWJ7czWsPruaJsGXAu1uLd HobYcWz48OCTrWHP5V4hT/6uD1ovgCHi1mnJv8OexwmzDVvPczS64xOSaswsUirdk/8R KSug== X-Gm-Message-State: AOAM531BlJM0600wgyDQNvuRn8UznasEggpb9/UBPhneRLiCM3SOIiM6 +NKPX9XKguZ1wY5p4RQSqpElXofx X-Google-Smtp-Source: ABdhPJyvfbpnG8f0g45i/nGY1bR9SBkQBNKXhxsxLK0J2RCTSfbUZAqAHAu5J4ZilTH23h/IOBvGsw== X-Received: by 2002:a63:5412:: with SMTP id i18mr4520670pgb.63.1594908373956; Thu, 16 Jul 2020 07:06:13 -0700 (PDT) Received: from localhost ([2600:1700:e321:62f0:329c:23ff:fee3:9d7c]) by smtp.gmail.com with ESMTPSA id g5sm286732pjl.31.2020.07.16.07.06.12 (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 16 Jul 2020 07:06:13 -0700 (PDT) Date: Thu, 16 Jul 2020 07:06:12 -0700 From: Guenter Roeck To: "krzysztof.sobota@nokia.com" Cc: wim@linux-watchdog.org, linux-watchdog@vger.kernel.org, linux-kernel@vger.kernel.org, alexander.sverdlin@nokia.com Subject: Re: [PATCH v3] watchdog: initialize device before misc_register Message-ID: <20200716140612.GA130965@roeck-us.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.9.4 (2018-02-28) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Jul 16, 2020 at 01:32:12PM +0200, krzysztof.sobota@nokia.com wrote: > When watchdog device is being registered, it calls misc_register that > makes watchdog available for systemd to open. This is a data race > scenario, because when device is open it may still have device struct > not initialized - this in turn causes a crash. This patch moves > device initialization before misc_register call and it solves the > problem printed below. > > ------------[ cut here ]------------ > WARNING: CPU: 3 PID: 1 at lib/kobject.c:612 kobject_get+0x50/0x54 > kobject: '(null)' ((ptrval)): is not initialized, yet kobject_get() is being called. > Modules linked in: k2_reset_status(O) davinci_wdt(+) sfn_platform_hwbcn(O) fsmddg_sfn(O) clk_misc_mmap(O) clk_sw_bcn(O) fsp_reset(O) cma_mod(O) slave_sup_notif(O) fpga_master(O) latency(O+) evnotify(O) enable_arm_pmu(O) xge(O) rio_mport_cdev br_netfilter bridge stp llc nvrd_checksum(O) ipv6 > CPU: 3 PID: 1 Comm: systemd Tainted: G O 4.19.113-g2579778-fsm4_k2 #1 > Hardware name: Keystone > [] (unwind_backtrace) from [] (show_stack+0x18/0x1c) > [] (show_stack) from [] (dump_stack+0xb4/0xe8) > [] (dump_stack) from [] (__warn+0xfc/0x114) > [] (__warn) from [] (warn_slowpath_fmt+0x50/0x74) > [] (warn_slowpath_fmt) from [] (kobject_get+0x50/0x54) > [] (kobject_get) from [] (get_device+0x1c/0x24) > [] (get_device) from [] (watchdog_open+0x90/0xf0) > [] (watchdog_open) from [] (misc_open+0x130/0x17c) > [] (misc_open) from [] (chrdev_open+0xec/0x1a8) > [] (chrdev_open) from [] (do_dentry_open+0x204/0x3cc) > [] (do_dentry_open) from [] (path_openat+0x330/0x1148) > [] (path_openat) from [] (do_filp_open+0x78/0xec) > [] (do_filp_open) from [] (do_sys_open+0x130/0x1f4) > [] (do_sys_open) from [] (ret_fast_syscall+0x0/0x28) > Exception stack(0xd2ceffa8 to 0xd2cefff0) > ffa0: b6f69968 00000000 ffffff9c b6ebd210 000a0001 00000000 > ffc0: b6f69968 00000000 00000000 00000142 fffffffd ffffffff 00b65530 bed7bb78 > ffe0: 00000142 bed7ba70 b6cc2503 b6cc41d6 > ---[ end trace 7b16eb105513974f ]--- > > ------------[ cut here ]------------ > WARNING: CPU: 3 PID: 1 at lib/refcount.c:153 kobject_get+0x24/0x54 > refcount_t: increment on 0; use-after-free. > Modules linked in: k2_reset_status(O) davinci_wdt(+) sfn_platform_hwbcn(O) fsmddg_sfn(O) clk_misc_mmap(O) clk_sw_bcn(O) fsp_reset(O) cma_mod(O) slave_sup_notif(O) fpga_master(O) latency(O+) evnotify(O) enable_arm_pmu(O) xge(O) rio_mport_cdev br_netfilter bridge stp llc nvrd_checksum(O) ipv6 > CPU: 3 PID: 1 Comm: systemd Tainted: G W O 4.19.113-g2579778-fsm4_k2 #1 > Hardware name: Keystone > [] (unwind_backtrace) from [] (show_stack+0x18/0x1c) > [] (show_stack) from [] (dump_stack+0xb4/0xe8) > [] (dump_stack) from [] (__warn+0xfc/0x114) > [] (__warn) from [] (warn_slowpath_fmt+0x50/0x74) > [] (warn_slowpath_fmt) from [] (kobject_get+0x24/0x54) > [] (kobject_get) from [] (get_device+0x1c/0x24) > [] (get_device) from [] (watchdog_open+0x90/0xf0) > [] (watchdog_open) from [] (misc_open+0x130/0x17c) > [] (misc_open) from [] (chrdev_open+0xec/0x1a8) > [] (chrdev_open) from [] (do_dentry_open+0x204/0x3cc) > [] (do_dentry_open) from [] (path_openat+0x330/0x1148) > [] (path_openat) from [] (do_filp_open+0x78/0xec) > [] (do_filp_open) from [] (do_sys_open+0x130/0x1f4) > [] (do_sys_open) from [] (ret_fast_syscall+0x0/0x28) > Exception stack(0xd2ceffa8 to 0xd2cefff0) > ffa0: b6f69968 00000000 ffffff9c b6ebd210 000a0001 00000000 > ffc0: b6f69968 00000000 00000000 00000142 fffffffd ffffffff 00b65530 bed7bb78 > ffe0: 00000142 bed7ba70 b6cc2503 b6cc41d6 > ---[ end trace 7b16eb1055139750 ]--- > > Fixes: 72139dfa2464 ("watchdog: Fix the race between the release of watchdog_core_data and cdev") > Reviewed-by: Guenter Roeck > Signed-off-by: Krzysztof Sobota > --- > v1 -> v2: > * removed Change-Id tag > * added Review-by tag > v2 -> v3 > * convert spaces to tabs > * convert (hopefully) mail to plaintext Doesn't look like it. Applying: watchdog: initialize device before misc_register error: corrupt patch at line 17 Patch failed at 0001 watchdog: initialize device before misc_register Use 'git am --show-current-patch' to see the failed patch When you have resolved this problem, run "git am --continue". If you prefer to skip this patch, run "git am --skip" instead. To restore the original branch and stop patching, run "git am --abort". Guenter > --- > drivers/watchdog/watchdog_dev.c | 18 +++++++++--------- > 1 file changed, 9 insertions(+), 9 deletions(-) > > diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c > index 10b2090f3e5e..1c322caecf7f 100644 > --- a/drivers/watchdog/watchdog_dev.c > +++ b/drivers/watchdog/watchdog_dev.c > @@ -947,6 +947,15 @@ static int watchdog_cdev_register(struct watchdog_device *wdd) > if (IS_ERR_OR_NULL(watchdog_kworker)) > return -ENODEV; > > + device_initialize(&wd_data->dev); > + wd_data->dev.devt = MKDEV(MAJOR(watchdog_devt), wdd->id); > + wd_data->dev.class = &watchdog_class; > + wd_data->dev.parent = wdd->parent; > + wd_data->dev.groups = wdd->groups; > + wd_data->dev.release = watchdog_core_data_release; > + dev_set_drvdata(&wd_data->dev, wdd); > + dev_set_name(&wd_data->dev, "watchdog%d", wdd->id); > + > kthread_init_work(&wd_data->work, watchdog_ping_work); > hrtimer_init(&wd_data->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); > wd_data->timer.function = watchdog_timer_expired; > @@ -967,15 +976,6 @@ static int watchdog_cdev_register(struct watchdog_device *wdd) > } > } > > - device_initialize(&wd_data->dev); > - wd_data->dev.devt = MKDEV(MAJOR(watchdog_devt), wdd->id); > - wd_data->dev.class = &watchdog_class; > - wd_data->dev.parent = wdd->parent; > - wd_data->dev.groups = wdd->groups; > - wd_data->dev.release = watchdog_core_data_release; > - dev_set_drvdata(&wd_data->dev, wdd); > - dev_set_name(&wd_data->dev, "watchdog%d", wdd->id); > - > /* Fill in the data structures */ > cdev_init(&wd_data->cdev, &watchdog_fops); > > -- > 2.14.0 >