From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Kevin Hao <haokexin@gmail.com>, Wolfram Sang <wsa@the-dreams.de>,
Sasha Levin <sashal@kernel.org>,
linux-i2c@vger.kernel.org
Subject: [PATCH AUTOSEL 4.19 49/66] i2c: dev: Fix the race between the release of i2c_dev and cdev
Date: Sat, 11 Apr 2020 19:11:46 -0400 [thread overview]
Message-ID: <20200411231203.25933-49-sashal@kernel.org> (raw)
In-Reply-To: <20200411231203.25933-1-sashal@kernel.org>
From: Kevin Hao <haokexin@gmail.com>
[ Upstream commit 1413ef638abae4ab5621901cf4d8ef08a4a48ba6 ]
The struct cdev is embedded in the struct i2c_dev. In the current code,
we would free the i2c_dev struct directly in put_i2c_dev(), but the
cdev is manged by a kobject, and the release of it is not predictable.
So it is very possible that the i2c_dev is freed before the cdev is
entirely released. We can easily get the following call trace with
CONFIG_DEBUG_KOBJECT_RELEASE and CONFIG_DEBUG_OBJECTS_TIMERS enabled.
ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x38
WARNING: CPU: 19 PID: 1 at lib/debugobjects.c:325 debug_print_object+0xb0/0xf0
Modules linked in:
CPU: 19 PID: 1 Comm: swapper/0 Tainted: G W 5.2.20-yocto-standard+ #120
Hardware name: Marvell OcteonTX CN96XX board (DT)
pstate: 80c00089 (Nzcv daIf +PAN +UAO)
pc : debug_print_object+0xb0/0xf0
lr : debug_print_object+0xb0/0xf0
sp : ffff00001292f7d0
x29: ffff00001292f7d0 x28: ffff800b82151788
x27: 0000000000000001 x26: ffff800b892c0000
x25: ffff0000124a2558 x24: 0000000000000000
x23: ffff00001107a1d8 x22: ffff0000116b5088
x21: ffff800bdc6afca8 x20: ffff000012471ae8
x19: ffff00001168f2c8 x18: 0000000000000010
x17: 00000000fd6f304b x16: 00000000ee79de43
x15: ffff800bc0e80568 x14: 79616c6564203a74
x13: 6e6968207473696c x12: 5f72656d6974203a
x11: ffff0000113f0018 x10: 0000000000000000
x9 : 000000000000001f x8 : 0000000000000000
x7 : ffff0000101294cc x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001
x3 : 00000000ffffffff x2 : 0000000000000000
x1 : 387fc15c8ec0f200 x0 : 0000000000000000
Call trace:
debug_print_object+0xb0/0xf0
__debug_check_no_obj_freed+0x19c/0x228
debug_check_no_obj_freed+0x1c/0x28
kfree+0x250/0x440
put_i2c_dev+0x68/0x78
i2cdev_detach_adapter+0x60/0xc8
i2cdev_notifier_call+0x3c/0x70
notifier_call_chain+0x8c/0xe8
blocking_notifier_call_chain+0x64/0x88
device_del+0x74/0x380
device_unregister+0x54/0x78
i2c_del_adapter+0x278/0x2d0
unittest_i2c_bus_remove+0x3c/0x80
platform_drv_remove+0x30/0x50
device_release_driver_internal+0xf4/0x1c0
driver_detach+0x58/0xa0
bus_remove_driver+0x84/0xd8
driver_unregister+0x34/0x60
platform_driver_unregister+0x20/0x30
of_unittest_overlay+0x8d4/0xbe0
of_unittest+0xae8/0xb3c
do_one_initcall+0xac/0x450
do_initcall_level+0x208/0x224
kernel_init_freeable+0x2d8/0x36c
kernel_init+0x18/0x108
ret_from_fork+0x10/0x1c
irq event stamp: 3934661
hardirqs last enabled at (3934661): [<ffff00001009fa04>] debug_exception_exit+0x4c/0x58
hardirqs last disabled at (3934660): [<ffff00001009fb14>] debug_exception_enter+0xa4/0xe0
softirqs last enabled at (3934654): [<ffff000010081d94>] __do_softirq+0x46c/0x628
softirqs last disabled at (3934649): [<ffff0000100b4a1c>] irq_exit+0x104/0x118
This is a common issue when using cdev embedded in a struct.
Fortunately, we already have a mechanism to solve this kind of issue.
Please see commit 233ed09d7fda ("chardev: add helper function to
register char devs with a struct device") for more detail.
In this patch, we choose to embed the struct device into the i2c_dev,
and use the API provided by the commit 233ed09d7fda to make sure that
the release of i2c_dev and cdev are in sequence.
Signed-off-by: Kevin Hao <haokexin@gmail.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/i2c-dev.c | 48 +++++++++++++++++++++++--------------------
1 file changed, 26 insertions(+), 22 deletions(-)
diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
index cb07651f4b467..cbda91a0cb5f8 100644
--- a/drivers/i2c/i2c-dev.c
+++ b/drivers/i2c/i2c-dev.c
@@ -48,7 +48,7 @@
struct i2c_dev {
struct list_head list;
struct i2c_adapter *adap;
- struct device *dev;
+ struct device dev;
struct cdev cdev;
};
@@ -92,12 +92,14 @@ static struct i2c_dev *get_free_i2c_dev(struct i2c_adapter *adap)
return i2c_dev;
}
-static void put_i2c_dev(struct i2c_dev *i2c_dev)
+static void put_i2c_dev(struct i2c_dev *i2c_dev, bool del_cdev)
{
spin_lock(&i2c_dev_list_lock);
list_del(&i2c_dev->list);
spin_unlock(&i2c_dev_list_lock);
- kfree(i2c_dev);
+ if (del_cdev)
+ cdev_device_del(&i2c_dev->cdev, &i2c_dev->dev);
+ put_device(&i2c_dev->dev);
}
static ssize_t name_show(struct device *dev,
@@ -636,6 +638,14 @@ static const struct file_operations i2cdev_fops = {
static struct class *i2c_dev_class;
+static void i2cdev_dev_release(struct device *dev)
+{
+ struct i2c_dev *i2c_dev;
+
+ i2c_dev = container_of(dev, struct i2c_dev, dev);
+ kfree(i2c_dev);
+}
+
static int i2cdev_attach_adapter(struct device *dev, void *dummy)
{
struct i2c_adapter *adap;
@@ -652,27 +662,23 @@ static int i2cdev_attach_adapter(struct device *dev, void *dummy)
cdev_init(&i2c_dev->cdev, &i2cdev_fops);
i2c_dev->cdev.owner = THIS_MODULE;
- res = cdev_add(&i2c_dev->cdev, MKDEV(I2C_MAJOR, adap->nr), 1);
- if (res)
- goto error_cdev;
-
- /* register this i2c device with the driver core */
- i2c_dev->dev = device_create(i2c_dev_class, &adap->dev,
- MKDEV(I2C_MAJOR, adap->nr), NULL,
- "i2c-%d", adap->nr);
- if (IS_ERR(i2c_dev->dev)) {
- res = PTR_ERR(i2c_dev->dev);
- goto error;
+
+ device_initialize(&i2c_dev->dev);
+ i2c_dev->dev.devt = MKDEV(I2C_MAJOR, adap->nr);
+ i2c_dev->dev.class = i2c_dev_class;
+ i2c_dev->dev.parent = &adap->dev;
+ i2c_dev->dev.release = i2cdev_dev_release;
+ dev_set_name(&i2c_dev->dev, "i2c-%d", adap->nr);
+
+ res = cdev_device_add(&i2c_dev->cdev, &i2c_dev->dev);
+ if (res) {
+ put_i2c_dev(i2c_dev, false);
+ return res;
}
pr_debug("i2c-dev: adapter [%s] registered as minor %d\n",
adap->name, adap->nr);
return 0;
-error:
- cdev_del(&i2c_dev->cdev);
-error_cdev:
- put_i2c_dev(i2c_dev);
- return res;
}
static int i2cdev_detach_adapter(struct device *dev, void *dummy)
@@ -688,9 +694,7 @@ static int i2cdev_detach_adapter(struct device *dev, void *dummy)
if (!i2c_dev) /* attach_adapter must have failed */
return 0;
- cdev_del(&i2c_dev->cdev);
- put_i2c_dev(i2c_dev);
- device_destroy(i2c_dev_class, MKDEV(I2C_MAJOR, adap->nr));
+ put_i2c_dev(i2c_dev, true);
pr_debug("i2c-dev: adapter [%s] unregistered\n", adap->name);
return 0;
--
2.20.1
next prev parent reply other threads:[~2020-04-11 23:13 UTC|newest]
Thread overview: 67+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-11 23:10 [PATCH AUTOSEL 4.19 01/66] net: wan: wanxl: use allow to pass CROSS_COMPILE_M68k for rebuilding firmware Sasha Levin
2020-04-11 23:10 ` [PATCH AUTOSEL 4.19 02/66] net: phy: probe PHY drivers synchronously Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 03/66] RDMA/rxe: Set sys_image_guid to be aligned with HW IB devices Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 04/66] mmc: sdhci: do not enable card detect interrupt for gpio cd type Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 05/66] serial: 8250_omap: Fix sleeping function called from invalid context during probe Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 06/66] net: phy: mscc: accept all RGMII species in vsc85xx_mac_if_set Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 07/66] RDMA/bnxt_re: Fix lifetimes in bnxt_re_task Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 08/66] RDMA/cm: Add missing locking around id.state in cm_dup_req_handler Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 09/66] NTB: set peer_sta within event handler itself Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 10/66] ntb_tool: Fix printk format Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 11/66] ath10k: use kzalloc to read for ath10k_sdio_hif_diag_read Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 12/66] mwifiex: set needed_headroom, not hard_header_len Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 13/66] Bluetooth: L2CAP: handle l2cap config request during open state Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 14/66] drm/tegra: dc: Release PM and RGB output when client's registration fails Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 15/66] drm/amd/display: Stop if retimer is not available Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 16/66] net/mlx5e: Init ethtool steering for representors Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 17/66] drm/amd/display: writing stereo polarity register if swapped Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 18/66] Bluetooth: Fix calculation of SCO handle for packet processing Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 19/66] net: rmnet: add missing module alias Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 20/66] drm/amd/display: Fix default logger mask definition Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 21/66] IB/mlx5: Fix missing congestion control debugfs on rep rdma device Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 22/66] Bluetooth: guard against controllers sending zero'd events Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 23/66] crypto: chelsio - Endianess bug in create_authenc_wr Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 24/66] RDMA/rxe: Fix configuration of atomic queue pair attributes Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 25/66] net: intel: e1000e: fix possible sleep-in-atomic-context bugs in e1000e_get_hw_semaphore() Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 26/66] net: dsa: bcm_sf2: Also configure Port 5 for 2Gb/sec on 7278 Sasha Levin
2020-04-12 1:16 ` Florian Fainelli
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 27/66] sh_eth: check sh_eth_cpu_data::no_tx_cntrs when dumping registers Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 28/66] sh_eth: check sh_eth_cpu_data::cexcr " Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 29/66] sh_eth: check sh_eth_cpu_data::no_xdfar " Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 30/66] drm/sun4i: dsi: Use NULL to signify "no panel" Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 31/66] crypto: chelsio - This fixes the kernel panic which occurs during a libkcapi test Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 32/66] crypto: tcrypt - fix printed skcipher [a]sync mode Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 33/66] drm/omap: fix possible object reference leak Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 34/66] audit: CONFIG_CHANGE don't log internal bookkeeping as an event Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 35/66] Bluetooth: btusb: Add support for 13d3:3548 Realtek 8822CE device Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 36/66] drm/stm: ltdc: check crtc state before enabling LIE Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 37/66] scsi: lpfc: Fix RQ buffer leakage when no IOCBs available Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 38/66] rsi: fix null pointer dereference during rsi_shutdown() Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 39/66] drm/amd/display: dal_ddc_i2c_payloads_create can fail causing panic Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 40/66] RDMA/ucma: Put a lock around every call to the rdma_cm layer Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 41/66] Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 42/66] xfs: clear PF_MEMALLOC before exiting xfsaild thread Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 43/66] ath10k: start recovery process when read int status fail for sdio Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 44/66] scsi: aacraid: Disabling TM path and only processing IOP reset Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 45/66] RDMA/cm: Remove a race freeing timewait_info Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 46/66] KVM: PPC: Book3S HV: Treat TM-related invalid form instructions on P9 like the valid ones Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 47/66] drm/msm: fix leaks if initialization fails Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 48/66] drm/msm/a5xx: Always set an OPP supported hardware value Sasha Levin
2020-04-11 23:11 ` Sasha Levin [this message]
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 50/66] brcmfmac: Fix driver crash on USB control transfer timeout Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 51/66] RDMA/cm: Update num_paths in cma_resolve_iboe_route error flow Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 52/66] crypto/chtls: Fix chtls crash in connection cleanup Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 53/66] ASoC: Intel: Skylake: Enable codec wakeup during chip init Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 54/66] scsi: qla2xxx: fix FW resource count values Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 55/66] of: of_reserved_mem: Increase limit on number of reserved regions Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 56/66] dmaengine: stm32-dma: use reset controller only at probe time Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 57/66] scsi: qla2xxx: Add fixes for mailbox command Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 58/66] scsi: qla2xxx: Fix control flags for login/logout IOCB Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 59/66] scsi: ufs: Fix ufshcd_hold() caused scheduling while atomic Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 60/66] bus: hisi_lpc: Fixup IO ports addresses to avoid use-after-free in host removal Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 61/66] rtc: cmos: Use spin_lock_irqsave() in cmos_interrupt() Sasha Levin
2020-04-11 23:11 ` [PATCH AUTOSEL 4.19 62/66] nfsd: Don't add locks to closed or closing open stateids Sasha Levin
2020-04-11 23:12 ` [PATCH AUTOSEL 4.19 63/66] ext4: check for non-zero journal inum in ext4_calculate_overhead Sasha Levin
2020-04-11 23:12 ` [PATCH AUTOSEL 4.19 64/66] ext4: avoid ENOSPC when avoiding to reuse recently deleted inodes Sasha Levin
2020-04-11 23:12 ` [PATCH AUTOSEL 4.19 65/66] svcrdma: Fix leak of transport addresses Sasha Levin
2020-04-11 23:12 ` [PATCH AUTOSEL 4.19 66/66] PCI: Use ioremap(), not phys_to_virt() for platform ROM Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200411231203.25933-49-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=haokexin@gmail.com \
--cc=linux-i2c@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=wsa@the-dreams.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).