[PATCH 0/2] MCB: two additional fixes for v4.7

[PATCH 0/2] MCB: two additional fixes for v4.7

[Johannes Thumshirn]

Hi Greg,

Here are two additional fixes for MCB from me, which would be good to have in
v4.7.

One fixes a panic when doing a insmod/rmmod loop and one grabs a reference to
the carrier driver's module as long as client drivers are loaded.

Both bugs have been reported by Andy and he tested the fixes as well.

Sorry for being so close to the merge window.

Johannes Thumshirn (2):
  mcb: Acquire reference to device in probe
  mcb: Acquire reference to carrier module in core

 drivers/mcb/mcb-core.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

-- 
2.8.1

[PATCH 1/2] mcb: Acquire reference to device in probe

[Johannes Thumshirn]

mcb_probe() does not aqcuire a reference to the probed device but drops one
when removing the device. As it is actually using the device, it should grab
a reference via get_device().

This could lead to a panic found with a rmmod/modprobe stress test

Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
Reported-by: Andreas Werner <andreas.werner@men.de>
Tested-by: Andreas Werner <andreas.werner@men.de>
---
 drivers/mcb/mcb-core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mcb/mcb-core.c b/drivers/mcb/mcb-core.c
index b73c6e7..f5923c2 100644
--- a/drivers/mcb/mcb-core.c
+++ b/drivers/mcb/mcb-core.c
@@ -66,6 +66,7 @@ static int mcb_probe(struct device *dev)
 	if (!found_id)
 		return -ENODEV;
 
+	get_device(dev);
 	return mdrv->probe(mdev, found_id);
 }
 
-- 
2.8.1

[PATCH 2/2] mcb: Acquire reference to carrier module in core

[Johannes Thumshirn]

Acquire a reference to the carrier's kernel module in bus code, so
it can't be removed from the kernel while it still has a bus and thus
possibly devices attached to it.

Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
Reported-by: Andreas Werner <andreas.werner@men.de>
Tested-by: Andreas Werner <andreas.werner@men.de>
---
 drivers/mcb/mcb-core.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/drivers/mcb/mcb-core.c b/drivers/mcb/mcb-core.c
index f5923c2..6f2c852 100644
--- a/drivers/mcb/mcb-core.c
+++ b/drivers/mcb/mcb-core.c
@@ -61,22 +61,36 @@ static int mcb_probe(struct device *dev)
 	struct mcb_driver *mdrv = to_mcb_driver(dev->driver);
 	struct mcb_device *mdev = to_mcb_device(dev);
 	const struct mcb_device_id *found_id;
+	struct module *carrier_mod;
+	int ret;
 
 	found_id = mcb_match_id(mdrv->id_table, mdev);
 	if (!found_id)
 		return -ENODEV;
 
+	carrier_mod = mdev->dev.parent->driver->owner;
+	if (!try_module_get(carrier_mod))
+		return -EINVAL;
+
 	get_device(dev);
-	return mdrv->probe(mdev, found_id);
+	ret = mdrv->probe(mdev, found_id);
+	if (ret)
+		module_put(carrier_mod);
+
+	return ret;
 }
 
 static int mcb_remove(struct device *dev)
 {
 	struct mcb_driver *mdrv = to_mcb_driver(dev->driver);
 	struct mcb_device *mdev = to_mcb_device(dev);
+	struct module *carrier_mod;
 
 	mdrv->remove(mdev);
 
+	carrier_mod = mdev->dev.parent->driver->owner;
+	module_put(carrier_mod);
+
 	put_device(&mdev->dev);
 
 	return 0;
-- 
2.8.1

Re: [PATCH 0/2] MCB: two additional fixes for v4.7

[Johannes Thumshirn]

On Tue, May 10, 2016 at 12:39:43PM +0200, Johannes Thumshirn wrote:
> Hi Greg,
> 
> Here are two additional fixes for MCB from me, which would be good to have in
> v4.7.
> 
> One fixes a panic when doing a insmod/rmmod loop and one grabs a reference to
> the carrier driver's module as long as client drivers are loaded.
> 
> Both bugs have been reported by Andy and he tested the fixes as well.
> 
> Sorry for being so close to the merge window.
> 
> Johannes Thumshirn (2):
>   mcb: Acquire reference to device in probe
>   mcb: Acquire reference to carrier module in core
> 
>  drivers/mcb/mcb-core.c | 17 ++++++++++++++++-
>  1 file changed, 16 insertions(+), 1 deletion(-)
> 
> -- 
> 2.8.1
> 

Hi Greg,

Sorry for pinging you in the merge window, but have you seen the patches,
or shall I re-send them? It would be nice to get them into v4.7 but I'd be
OK with v4.8 as well.

Thanks,
	Johannes

-- 
Johannes Thumshirn                                          Storage
jthumshirn@suse.de                                +49 911 74053 689
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg
GF: Felix Imendörffer, Jane Smithard, Graham Norton
HRB 21284 (AG Nürnberg)
Key fingerprint = EC38 9CAB C2C4 F25D 8600 D0D0 0393 969D 2D76 0850

Re: [PATCH 0/2] MCB: two additional fixes for v4.7

[Greg KH]

On Mon, May 30, 2016 at 01:15:29PM +0200, Johannes Thumshirn wrote:
> On Tue, May 10, 2016 at 12:39:43PM +0200, Johannes Thumshirn wrote:
> > Hi Greg,
> > 
> > Here are two additional fixes for MCB from me, which would be good to have in
> > v4.7.
> > 
> > One fixes a panic when doing a insmod/rmmod loop and one grabs a reference to
> > the carrier driver's module as long as client drivers are loaded.
> > 
> > Both bugs have been reported by Andy and he tested the fixes as well.
> > 
> > Sorry for being so close to the merge window.
> > 
> > Johannes Thumshirn (2):
> >   mcb: Acquire reference to device in probe
> >   mcb: Acquire reference to carrier module in core
> > 
> >  drivers/mcb/mcb-core.c | 17 ++++++++++++++++-
> >  1 file changed, 16 insertions(+), 1 deletion(-)
> > 
> > -- 
> > 2.8.1
> > 
> 
> Hi Greg,
> 
> Sorry for pinging you in the merge window, but have you seen the patches,
> or shall I re-send them? It would be nice to get them into v4.7 but I'd be
> OK with v4.8 as well.

Sorry for the delay, both now applied.

greg k-h