linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 1/2] lp8727_charger: free_irq when lp8727_register_psy fail
@ 2012-07-29 17:46 Devendra Naga
  2012-08-10  4:35 ` Devendra
  2012-08-10  5:07 ` Devendra Naga
  0 siblings, 2 replies; 6+ messages in thread
From: Devendra Naga @ 2012-07-29 17:46 UTC (permalink / raw)
  To: Anton Vorontsov, David Woodhouse, linux-kernel; +Cc: Devendra Naga

actually the driver does a request_threaded_irq and after this it calls
lp8727_register_psy, and if it fails it doesn't free the irqs that it
registered to

Signed-off-by: Devendra Naga <develkernel412222@gmail.com>
---
 drivers/power/lp8727_charger.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/power/lp8727_charger.c b/drivers/power/lp8727_charger.c
index d8b7578..699f0ef 100644
--- a/drivers/power/lp8727_charger.c
+++ b/drivers/power/lp8727_charger.c
@@ -454,11 +454,13 @@ static int lp8727_probe(struct i2c_client *cl, const struct i2c_device_id *id)
 	ret = lp8727_register_psy(pchg);
 	if (ret) {
 		dev_err(pchg->dev, "power supplies register err: %d", ret);
-		goto error;
+		goto error_irq;
 	}
 
 	return 0;
 
+error_irq:
+	free_irq(pchg->client->irq, pchg);
 error:
 	kfree(pchg);
 	return ret;
-- 
1.7.9.5


^ permalink raw reply related	[flat|nested] 6+ messages in thread

* Re: [PATCH 1/2] lp8727_charger: free_irq when lp8727_register_psy fail
  2012-07-29 17:46 [PATCH 1/2] lp8727_charger: free_irq when lp8727_register_psy fail Devendra Naga
@ 2012-08-10  4:35 ` Devendra
  2012-08-19 20:50   ` Anton Vorontsov
  2012-08-10  5:07 ` Devendra Naga
  1 sibling, 1 reply; 6+ messages in thread
From: Devendra @ 2012-08-10  4:35 UTC (permalink / raw)
  To: Anton Vorontsov; +Cc: David Woodhouse, linux-kernel

Sorry Guys on disturbing you,

Will you guys please ACK, NACK or comment on this?

Thanks,

On Sun, 2012-07-29 at 23:31 +0545, Devendra Naga wrote:
> actually the driver does a request_threaded_irq and after this it calls
> lp8727_register_psy, and if it fails it doesn't free the irqs that it
> registered to
> 
> Signed-off-by: Devendra Naga <develkernel412222@gmail.com>
> ---
>  drivers/power/lp8727_charger.c |    4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/power/lp8727_charger.c b/drivers/power/lp8727_charger.c
> index d8b7578..699f0ef 100644
> --- a/drivers/power/lp8727_charger.c
> +++ b/drivers/power/lp8727_charger.c
> @@ -454,11 +454,13 @@ static int lp8727_probe(struct i2c_client *cl, const struct i2c_device_id *id)
>  	ret = lp8727_register_psy(pchg);
>  	if (ret) {
>  		dev_err(pchg->dev, "power supplies register err: %d", ret);
> -		goto error;
> +		goto error_irq;
>  	}
>  
>  	return 0;
>  
> +error_irq:
> +	free_irq(pchg->client->irq, pchg);
>  error:
>  	kfree(pchg);
>  	return ret;



^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH 1/2] lp8727_charger: free_irq when lp8727_register_psy fail
  2012-07-29 17:46 [PATCH 1/2] lp8727_charger: free_irq when lp8727_register_psy fail Devendra Naga
  2012-08-10  4:35 ` Devendra
@ 2012-08-10  5:07 ` Devendra Naga
  1 sibling, 0 replies; 6+ messages in thread
From: Devendra Naga @ 2012-08-10  5:07 UTC (permalink / raw)
  To: Anton Vorontsov, David Woodhouse, linux-kernel; +Cc: Devendra Naga

Sorry to ask this again,

But will anybody please ACK , NACK or comment on this patch?

Thanks,
Devendra.

On Sun, Jul 29, 2012 at 11:16 PM, Devendra Naga
<develkernel412222@gmail.com> wrote:
> actually the driver does a request_threaded_irq and after this it calls
> lp8727_register_psy, and if it fails it doesn't free the irqs that it
> registered to
>
> Signed-off-by: Devendra Naga <develkernel412222@gmail.com>
> ---
>  drivers/power/lp8727_charger.c |    4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/power/lp8727_charger.c b/drivers/power/lp8727_charger.c
> index d8b7578..699f0ef 100644
> --- a/drivers/power/lp8727_charger.c
> +++ b/drivers/power/lp8727_charger.c
> @@ -454,11 +454,13 @@ static int lp8727_probe(struct i2c_client *cl, const struct i2c_device_id *id)
>         ret = lp8727_register_psy(pchg);
>         if (ret) {
>                 dev_err(pchg->dev, "power supplies register err: %d", ret);
> -               goto error;
> +               goto error_irq;
>         }
>
>         return 0;
>
> +error_irq:
> +       free_irq(pchg->client->irq, pchg);
>  error:
>         kfree(pchg);
>         return ret;
> --
> 1.7.9.5
>

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH 1/2] lp8727_charger: free_irq when lp8727_register_psy fail
  2012-08-10  4:35 ` Devendra
@ 2012-08-19 20:50   ` Anton Vorontsov
  2012-08-23 16:52     ` Devendra Naga
  0 siblings, 1 reply; 6+ messages in thread
From: Anton Vorontsov @ 2012-08-19 20:50 UTC (permalink / raw)
  To: Devendra; +Cc: David Woodhouse, linux-kernel, Milo.Kim

On Fri, Aug 10, 2012 at 10:05:55AM +0530, Devendra wrote:
> Sorry Guys on disturbing you,
> 
> Will you guys please ACK, NACK or comment on this?

Technically, it looks OK. But the irq registration logic is sill broken,
and the hidden issue is much more serious.

1. lp8727_init_device() -> the function enables interrupts in hw;
2. lp8727_intr_config() -> the function requests interrupts, so CPU
   is now able to process them;
3. lp8727_register_psy() -> the function allocates power supply
   objects.

Now, the problem will arise if interrupt comes between "2." and
"3.", the interrupt service routine will cause NULL dereference.

So, what you really want to fix the driver is to reorder "2." and "3.",
and on error condition call lp8727_unregister_psy().

Thanks,

> On Sun, 2012-07-29 at 23:31 +0545, Devendra Naga wrote:
> > actually the driver does a request_threaded_irq and after this it calls
> > lp8727_register_psy, and if it fails it doesn't free the irqs that it
> > registered to
> > 
> > Signed-off-by: Devendra Naga <develkernel412222@gmail.com>
> > ---
> >  drivers/power/lp8727_charger.c |    4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/power/lp8727_charger.c b/drivers/power/lp8727_charger.c
> > index d8b7578..699f0ef 100644
> > --- a/drivers/power/lp8727_charger.c
> > +++ b/drivers/power/lp8727_charger.c
> > @@ -454,11 +454,13 @@ static int lp8727_probe(struct i2c_client *cl, const struct i2c_device_id *id)
> >  	ret = lp8727_register_psy(pchg);
> >  	if (ret) {
> >  		dev_err(pchg->dev, "power supplies register err: %d", ret);
> > -		goto error;
> > +		goto error_irq;
> >  	}
> >  
> >  	return 0;
> >  
> > +error_irq:
> > +	free_irq(pchg->client->irq, pchg);
> >  error:
> >  	kfree(pchg);
> >  	return ret;

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH 1/2] lp8727_charger: free_irq when lp8727_register_psy fail
  2012-08-19 20:50   ` Anton Vorontsov
@ 2012-08-23 16:52     ` Devendra Naga
  2012-08-30 11:41       ` Kim, Milo
  0 siblings, 1 reply; 6+ messages in thread
From: Devendra Naga @ 2012-08-23 16:52 UTC (permalink / raw)
  To: Anton Vorontsov; +Cc: David Woodhouse, linux-kernel, Milo.Kim

Hi Anton,

On Mon, Aug 20, 2012 at 2:20 AM, Anton Vorontsov <cbouatmailru@gmail.com> wrote:
> On Fri, Aug 10, 2012 at 10:05:55AM +0530, Devendra wrote:
>> Sorry Guys on disturbing you,
>>
>> Will you guys please ACK, NACK or comment on this?
>
> Technically, it looks OK. But the irq registration logic is sill broken,
> and the hidden issue is much more serious.
>
> 1. lp8727_init_device() -> the function enables interrupts in hw;
> 2. lp8727_intr_config() -> the function requests interrupts, so CPU
>    is now able to process them;
> 3. lp8727_register_psy() -> the function allocates power supply
>    objects.
>
> Now, the problem will arise if interrupt comes between "2." and
> "3.", the interrupt service routine will cause NULL dereference.
>
> So, what you really want to fix the driver is to reorder "2." and "3.",
> and on error condition call lp8727_unregister_psy().
>
I think i need to learn more in order to touch this path. will give a try.

Thanks,
> Thanks,
>
>> On Sun, 2012-07-29 at 23:31 +0545, Devendra Naga wrote:
>> > actually the driver does a request_threaded_irq and after this it calls
>> > lp8727_register_psy, and if it fails it doesn't free the irqs that it
>> > registered to
>> >
>> > Signed-off-by: Devendra Naga <develkernel412222@gmail.com>
>> > ---
>> >  drivers/power/lp8727_charger.c |    4 +++-
>> >  1 file changed, 3 insertions(+), 1 deletion(-)
>> >
>> > diff --git a/drivers/power/lp8727_charger.c b/drivers/power/lp8727_charger.c
>> > index d8b7578..699f0ef 100644
>> > --- a/drivers/power/lp8727_charger.c
>> > +++ b/drivers/power/lp8727_charger.c
>> > @@ -454,11 +454,13 @@ static int lp8727_probe(struct i2c_client *cl, const struct i2c_device_id *id)
>> >     ret = lp8727_register_psy(pchg);
>> >     if (ret) {
>> >             dev_err(pchg->dev, "power supplies register err: %d", ret);
>> > -           goto error;
>> > +           goto error_irq;
>> >     }
>> >
>> >     return 0;
>> >
>> > +error_irq:
>> > +   free_irq(pchg->client->irq, pchg);
>> >  error:
>> >     kfree(pchg);
>> >     return ret;

^ permalink raw reply	[flat|nested] 6+ messages in thread

* RE: [PATCH 1/2] lp8727_charger: free_irq when lp8727_register_psy fail
  2012-08-23 16:52     ` Devendra Naga
@ 2012-08-30 11:41       ` Kim, Milo
  0 siblings, 0 replies; 6+ messages in thread
From: Kim, Milo @ 2012-08-30 11:41 UTC (permalink / raw)
  To: Devendra Naga, Anton Vorontsov; +Cc: David Woodhouse, linux-kernel



Best Regards,
Milo


> -----Original Message-----
> From: Devendra Naga [mailto:develkernel412222@gmail.com]
> Sent: Friday, August 24, 2012 1:52 AM
> To: Anton Vorontsov
> Cc: David Woodhouse; linux-kernel@vger.kernel.org; Kim, Milo
> Subject: Re: [PATCH 1/2] lp8727_charger: free_irq when
> lp8727_register_psy fail
> 
> Hi Anton,
> 
> On Mon, Aug 20, 2012 at 2:20 AM, Anton Vorontsov
> <cbouatmailru@gmail.com> wrote:
> > On Fri, Aug 10, 2012 at 10:05:55AM +0530, Devendra wrote:
> >> Sorry Guys on disturbing you,
> >>
> >> Will you guys please ACK, NACK or comment on this?
> >
> > Technically, it looks OK. But the irq registration logic is sill
> broken,
> > and the hidden issue is much more serious.
> >
> > 1. lp8727_init_device() -> the function enables interrupts in hw;
> > 2. lp8727_intr_config() -> the function requests interrupts, so CPU
> >    is now able to process them;
> > 3. lp8727_register_psy() -> the function allocates power supply
> >    objects.
> >
> > Now, the problem will arise if interrupt comes between "2." and
> > "3.", the interrupt service routine will cause NULL dereference.
> >
> > So, what you really want to fix the driver is to reorder "2." and
> "3.",
> > and on error condition call lp8727_unregister_psy().

Please refer to the patch below.
[PATCH 2/8] lp8727_charger: cleanup _probe() and _remove()

Best Regards,
Milo

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2012-08-30 11:41 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-07-29 17:46 [PATCH 1/2] lp8727_charger: free_irq when lp8727_register_psy fail Devendra Naga
2012-08-10  4:35 ` Devendra
2012-08-19 20:50   ` Anton Vorontsov
2012-08-23 16:52     ` Devendra Naga
2012-08-30 11:41       ` Kim, Milo
2012-08-10  5:07 ` Devendra Naga

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).