From: Jonathan Cameron <jic23@kernel.org>
To: Lars-Peter Clausen <lars@metafoo.de>
Cc: Maxime Ripard <maxime@cerno.tech>,
Matti Vaittinen <mazziesaccount@gmail.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>,
"Rafael J. Wysocki" <rafael@kernel.org>,
Brendan Higgins <brendan.higgins@linux.dev>,
David Gow <davidgow@google.com>,
Andy Shevchenko <andriy.shevchenko@linux.intel.com>,
Heikki Krogerus <heikki.krogerus@linux.intel.com>,
linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org,
kunit-dev@googlegroups.com, Stephen Boyd <sboyd@kernel.org>,
linux-iio@vger.kernel.org
Subject: Re: [PATCH v5 1/8] drivers: kunit: Generic helpers for test device creation
Date: Sat, 1 Apr 2023 16:30:46 +0100 [thread overview]
Message-ID: <20230401163046.2bec03dd@jic23-huawei> (raw)
In-Reply-To: <d9d4894e-d386-dba5-3e6a-c48c5d143e45@metafoo.de>
On Sun, 26 Mar 2023 10:16:54 -0700
Lars-Peter Clausen <lars@metafoo.de> wrote:
> On 3/25/23 10:50, Jonathan Cameron wrote:
> > On Fri, 24 Mar 2023 13:31:57 +0100
> > Maxime Ripard <maxime@cerno.tech> wrote:
> >
> >> On Fri, Mar 24, 2023 at 08:11:52AM +0200, Matti Vaittinen wrote:
> >>> On 3/23/23 18:36, Maxime Ripard wrote:
> >>>> On Thu, Mar 23, 2023 at 03:02:03PM +0200, Matti Vaittinen wrote:
> >>>>> On 3/23/23 14:29, Maxime Ripard wrote:
> >>>>>> On Thu, Mar 23, 2023 at 02:16:52PM +0200, Matti Vaittinen wrote:
> >>>>>>
> >>>>>> This is the description of what was happening:
> >>>>>> https://lore.kernel.org/dri-devel/20221117165311.vovrc7usy4efiytl@houat/
> >>>>> Thanks Maxime. Do I read this correcty. The devm_ unwinding not being done
> >>>>> when root_device_register() is used is not because root_device_unregister()
> >>>>> would not trigger the unwinding - but rather because DRM code on top of this
> >>>>> device keeps the refcount increased?
> >>>> There's a difference of behaviour between a root_device and any device
> >>>> with a bus: the root_device will only release the devm resources when
> >>>> it's freed (in device_release), but a bus device will also do it in
> >>>> device_del (through bus_remove_device() -> device_release_driver() ->
> >>>> device_release_driver_internal() -> __device_release_driver() ->
> >>>> device_unbind_cleanup(), which are skipped (in multiple places) if
> >>>> there's no bus and no driver attached to the device).
> >>>>
> >>>> It does affect DRM, but I'm pretty sure it will affect any framework
> >>>> that deals with device hotplugging by deferring the framework structure
> >>>> until the last (userspace) user closes its file descriptor. So I'd
> >>>> assume that v4l2 and cec at least are also affected, and most likely
> >>>> others.
> >>> Thanks for the explanation and patience :)
> >>>
> >>>>
> >>>>> If this is the case, then it sounds like a DRM specific issue to me.
> >>>> I mean, I guess. One could also argue that it's because IIO doesn't
> >>>> properly deal with hotplugging.
> >>> I must say I haven't been testing the IIO registration API. I've only tested
> >>> the helper API which is not backed up by any "IIO device". (This is fine for
> >>> the helper because it must by design be cleaned-up only after the
> >>> IIO-deregistration).
> >>>
> >>> After your explanation here, I am not convinced IIO wouldn't see the same
> >>> issue if I was testing the devm_iio_device_alloc() & co.
> >> It depends really. The issue DRM is trying to solve is that, when a
> >> device is gone, some application might still have an open FD and could
> >> still poke into the kernel, while all the resources would have been
> >> free'd if it was using devm.
> >>
> >> So everything is kept around until the last fd is closed, so you still
> >> have a reference to the device (even though it's been removed from its
> >> bus) until that time.
> >>
> >> It could be possible that IIO just doesn't handle that case at all. I
> >> guess most of the devices aren't hotpluggable, and there's not much to
> >> interact with from a userspace PoV iirc, so it might be why.
> > Lars-Peter Clausen (IIRC) fixed up the IIO handling of the similar cases a
> > long time ago now. It's simpler that for some other subsystems as we don't
> > have as many interdependencies as occur in DRM etc.
> >
> > I 'think' we are fine in general with the IIO approach to this (I think we
> > did have one report of a theoretical race condition in the remove path that
> > was never fully addressed).
> >
> > For IIO we also have fds that can be open but all accesses to them are proxied
> > through the IIO core and one of the things iio_device_unregister() or the devm
> > equivalent does is to set indio_dev->info = NULL (+ wake up anyone waiting on
> > data etc). Alongside removing the callbacks, that is also used as a flag
> > to indicate the device has gone.
> >
> > Note that we keep a reference to the struct indio_dev->dev (rather that the
> > underlying device) so that is not freed until the last fd is closed.
> > Thus, although devm unwinding has occurred that doesn't mean all the data
> > that was allocated with devm_xx calls is cleared up immediately.
>
> IIO is fully hot-plug and hot-unplug capable. And it will have the same
> issue. When using managed device registration that establishes a parent
> child relationship between the devices and in combination with a device
> where the managed unwinding does not happen on unbind, but rather on in
> the release callback you create a cyclic reference dependency. The child
> device holds a reference to the parent, but the reference is only
> released in the parents release callback. And since that release
> callback is not called until the last reference is dropped you end up
> with a resource leak.
>
> There are even some other places where IIO drivers run into this. E.g.
> any driver that does `devm_iio_trigger_register(&indio_dev->dev, ...)`
A driver should should not do that.
Should be devm_iio_trigger_registers(parent device, ...)
There is a corner where you need to detach the trigger from userspace
before release which is odd if it was attached by default. There are some
left over corners there that I think still cause trouble.
> creates a resource leak on the trigger and the IIO device. The indio_dev
> is not a bus device, hence no unbind and the trigger holds a reference
> so the release callback will never be called either.
>
next prev parent reply other threads:[~2023-04-01 15:15 UTC|newest]
Thread overview: 61+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-03-22 9:05 [PATCH v5 0/8] Support ROHM BU27034 ALS sensor Matti Vaittinen
2023-03-22 9:05 ` [PATCH v5 1/8] drivers: kunit: Generic helpers for test device creation Matti Vaittinen
2023-03-22 12:04 ` Greg Kroah-Hartman
2023-03-22 12:07 ` Greg Kroah-Hartman
2023-03-22 13:48 ` Matti Vaittinen
2023-03-22 18:57 ` Greg Kroah-Hartman
2023-03-23 7:17 ` Vaittinen, Matti
2023-03-23 8:58 ` Greg Kroah-Hartman
2023-03-23 9:20 ` Matti Vaittinen
2023-03-23 10:25 ` Greg Kroah-Hartman
2023-03-23 10:43 ` Matti Vaittinen
2023-03-23 10:01 ` Matti Vaittinen
2023-03-23 10:27 ` Greg Kroah-Hartman
2023-03-23 11:00 ` Matti Vaittinen
2023-03-23 10:12 ` Maxime Ripard
2023-03-23 10:21 ` Greg Kroah-Hartman
2023-03-23 12:16 ` Matti Vaittinen
2023-03-23 12:29 ` Maxime Ripard
2023-03-23 13:02 ` Matti Vaittinen
2023-03-23 16:36 ` Maxime Ripard
2023-03-24 6:11 ` Matti Vaittinen
2023-03-24 6:34 ` David Gow
2023-03-24 6:51 ` Matti Vaittinen
2023-03-24 9:52 ` David Gow
2023-03-24 10:05 ` Matti Vaittinen
2023-03-24 10:17 ` Matti Vaittinen
2023-03-25 4:35 ` David Gow
2023-03-25 7:26 ` Matti Vaittinen
2023-03-24 12:46 ` Maxime Ripard
2023-03-24 12:31 ` Maxime Ripard
2023-03-25 5:40 ` David Gow
2023-03-29 19:43 ` Maxime Ripard
2023-03-25 17:50 ` Jonathan Cameron
2023-03-26 17:16 ` Lars-Peter Clausen
2023-04-01 15:30 ` Jonathan Cameron [this message]
2023-03-29 19:46 ` Maxime Ripard
2023-04-01 15:36 ` Jonathan Cameron
2023-03-24 12:36 ` Maxime Ripard
2023-03-24 12:43 ` Greg Kroah-Hartman
2023-03-24 13:02 ` Maxime Ripard
2023-03-24 13:42 ` Greg Kroah-Hartman
2023-03-22 12:08 ` Greg Kroah-Hartman
2023-03-23 7:30 ` David Gow
2023-03-23 8:35 ` Matti Vaittinen
2023-03-23 9:02 ` Greg Kroah-Hartman
2023-03-23 10:07 ` Maxime Ripard
2023-03-22 9:06 ` [PATCH v5 2/8] drm/tests: helpers: Use generic helpers Matti Vaittinen
2023-03-22 9:06 ` [PATCH v5 3/8] dt-bindings: iio: light: Support ROHM BU27034 Matti Vaittinen
2023-03-22 9:06 ` [PATCH v5 4/8] iio: light: Add gain-time-scale helpers Matti Vaittinen
2023-03-22 9:07 ` [PATCH v5 5/8] iio: test: test " Matti Vaittinen
2023-03-24 6:29 ` Matti Vaittinen
2023-03-22 9:07 ` [PATCH v5 6/8] MAINTAINERS: Add IIO " Matti Vaittinen
2023-03-22 9:07 ` [PATCH v5 7/8] iio: light: ROHM BU27034 Ambient Light Sensor Matti Vaittinen
2023-03-26 16:19 ` Jonathan Cameron
2023-03-27 7:16 ` Vaittinen, Matti
2023-03-22 9:08 ` [PATCH v5 8/8] MAINTAINERS: Add ROHM BU27034 Matti Vaittinen
2023-03-22 10:01 ` [PATCH v5 0/8] Support ROHM BU27034 ALS sensor Andy Shevchenko
2023-03-22 10:34 ` Javier Martinez Canillas
2023-03-22 10:59 ` Matti Vaittinen
2023-03-22 11:02 ` Andy Shevchenko
2023-03-23 9:28 ` Maxime Ripard
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230401163046.2bec03dd@jic23-huawei \
--to=jic23@kernel.org \
--cc=andriy.shevchenko@linux.intel.com \
--cc=brendan.higgins@linux.dev \
--cc=davidgow@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=heikki.krogerus@linux.intel.com \
--cc=kunit-dev@googlegroups.com \
--cc=lars@metafoo.de \
--cc=linux-iio@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=matti.vaittinen@fi.rohmeurope.com \
--cc=maxime@cerno.tech \
--cc=mazziesaccount@gmail.com \
--cc=rafael@kernel.org \
--cc=sboyd@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).