A few debug messages were missing newlines, add them
Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
We were testing hsotg pointer for null after we had already
dereferenced it
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The 'bustype' in the boardinfo is not used. Remove it.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Only the ISA versions of the LabPC boards support DMA and the
devpriv->dma_chan is only set during the ISA board attach if
DMA is available. The extra check of the board->bustype is not
necessary in labpc_ai_cmd().
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The PCI and PCMCIA LabPC boards use shared interrupts and need the
IRQF_SHARED flag set when requesting the irq, the ISA boards do not.
Instead of checking the 'bustype' in labpc_common_attach() in order
to determine the isr_flags, just pass the flags as a parameter to the
function.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Only the ISA versions of the LabPC boards support DMA. Move the DMA
initialization out of the labpc_common_attach() and put it in the
ISA specific labpc_attach() function.
Remove the 'dma_chan' parameter from labpc_common_attach().
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Currently the ni_labpc driver is used by the legacy (ISA), PCI, and
PCMCIA versions of the LabPC board. The driver is enabled under the
COMEDI_PCI_DRIVERS section of the Kconfig. This means that PCI support
must be enabled in order to use the ni_labpc driver for the PCI or
PCMCIA drivers.
Split the PCI support code out of the ni_labpc driver into a separate
driver, ni_labpc_pci. The PCMCIA support is already slip out as
ni_labpc_cs.
Modify the Kconfig so that the common code in ni_labpc is enabled by the
Kconfig option COMEDI_NI_LABPC. The ISA support code is currently still
in the ni_labpc driver but is only compiled in if COMEDI_NI_LABPC_ISA is
also enabled.
This allows the PCI and PCMCIA drivers to be enabled without the need
for the ISA stuff.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
On ARM, it is not legal to pass values larger than 2ms into udelay(),
and mdelay() must be used instead, to avoid this build error:
ERROR: "__bad_udelay" [drivers/staging/comedi/drivers/daqboard2000.ko]
undefined!
On a related note, any use of mdelay() or large udelay() numbers should
be carefully reviewed, and replaced with msleep() or a different
implementation that does not rely on delaying the work.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Cc: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The serio code can be a loadable module, which in turn means that nvec
also has to be a module, so mark it as "tristate" in Kconfig.
drivers/built-in.o: In function `nvec_mouse_remove':
drivers/staging/nvec/nvec_ps2.c:136: undefined reference to `serio_unregister_port'
drivers/built-in.o: In function `nvec_mouse_probe':
drivers/staging/nvec/nvec_ps2.c:126: undefined reference to `__serio_register_port'
drivers/built-in.o: In function `nvec_ps2_notifier':
drivers/staging/nvec/nvec_ps2.c:84: undefined reference to `serio_interrupt'
drivers/staging/nvec/nvec_ps2.c:91: undefined reference to `serio_interrupt'
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Cc: Marc Dietrich <marvin24@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Building zsmalloc as a module does not work on ARM because it uses
an interface that is not exported:
ERROR: "flush_tlb_kernel_range" [drivers/staging/zsmalloc/zsmalloc.ko] undefined!
Since this is only used as a performance optimization and only on ARM,
we can avoid the problem simply by not using that optimization when
building zsmalloc it is a loadable module.
flush_tlb_kernel_range is often an inline function, but out of the
architectures that use an extern function, only powerpc exports
it.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Seth Jennings <sjenning@linux.vnet.ibm.com>
Cc: Nitin Gupta <ngupta@vflare.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
If we're not maxed out then oz_get_pd_list() leaves part of the "list"
struct uninitialized. We should clear this so that no stack information
is leaked to userspace.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
If "nd->nd_vpd_len" is less than 512 then the last part of the
"vpd.vpd_data" has uninitialized stack information. We need to clear it
before copying the buffer to user space.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
All the RTC dma support code in this driver is #ifdef'ed out.
Remove the unused code to assist in cleaning up this driver.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Cc: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
All the RTC dma support code in this driver is #ifdef'ed out.
Remove the unused code to assist in cleaning up this driver.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Cc: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
All the legacy comedi drivers now call comedi_legacy_detach()
either directly or as part of their (*detach). Move the free_irq()
into comedi_legacy_detach() so that the drivers don't have to
deal with it.
For drivers that then only call comedi_legacy_detach() in their
private (*detach), remove the private function and use the helper
directly for the (*detach).
The amplc_pc236 and ni_labpc drivers are hybrid legacy/PCI drivers.
In the detach of a PCI board free_irq() still needs to be handled
by the driver.
The pcl724 and pcl726 drivers currently have the free_irq() #ifdef'ed
out. The comedi_legacy_detach() function sanity checks that the irq
has been requested before freeing it so they are safe to convert.
For aesthetic reasons, move the #ifdef unused chunk in the pcl816
driver up to the previous #ifdef unused block.
The pcmio and pcmuio drivers request multiple irqs and handle the
freeing of them. Remove the 'dev->irq = irq[0]' in those drivers
so that comedi_legacy_detach() does not attempt to free the irq.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Use comedi_legacy_detach() to release the I/O region requested
by these drivers.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Update the skeleton driver to use the new comedi_legacy_detach()
helper in the (*detach) to release the I/O region. Also, update
the comment about it.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The I/O region used by this driver is always requested using
comedi_request_region(). The devpriv->io union is only used by
the common code shared by the legacy and PCI drivers.
Use the new comedi_legacy_detach() helper in the (*detach) to
release the I/O region requested by this driver. That function
will handle the proper sanity checking before releasing the
resource.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Use the new comedi_legacy_detach() helper in the (*detach) to release
the I/O region requested by these drivers.
Since the (*detach) for these drivers only releases the region, remove
the private (*detach) functions and use comedi_legacy_detach() directly
for the (*detach).
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Use the new comedi_legacy_detach() helper in the (*detach) to release
the first I/O region requested by this driver.
An additional I/O region is requested for some of the boards this driver
supports. The iobase for that region is stored in the private data so
that the (*detach) knows it needs to be released. Remove the extra
cleanup in the (*attach) that releases the first region.
For aesthetics, move the release of the additional region in the
(*detach) so it follows the (*attach) order.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Make sure to check if subdev_8255_init() fails and propogate the
error code.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Use the new comedi_legacy_detach() helper in the (*detach) to release
the first I/O region requested by this driver.
An additional I/O region is requested by this driver for the 8255
device. Save the iobase for that region in the private data so that
the (*detach) knows it needs to be released.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Use the new comedi_legacy_detach() helper in the (*detach) to release
the first I/O region requested by this driver.
An additional I/O region is requested for some of the boards this driver
supports. Save the iobase for that region in the private data so that
the (*detach) knows it needs to be released.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This driver does not follow the standard (*attach) (*detach) flow of
the other drivers in comedi. Comedi drivers do not 'cleanup' any of
the allocations made during the (*attach) if failures are encountered.
If the (*attach) fails, the comedi core will call the (*detach) to
handle any clenaup.
In this driver, the function free_resources() handles all the cleanup.
Remove the calls to this function during the (*attach). Since the
(*detach) is then the only caller, remove the function and just put
all the cleanup in the (*detach) function.
Use the new comedi_legacy_detach() helper in the (*detach) to release
the I/O region.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This function is intended to be used by the comedi legacy (ISA) drivers
either directly as the (*detach) function or as a helper in the drivers
private (*detach) function.
Modify the comedi_request_region() helper so that it stores the 'len' of
the region as well as the 'start' after the region has been successfuly
allocated by request_region() in __comedi_request_region(). This region
will then be automatically released detach of the driver by the
comedi_legacy_detach() helper.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The custom filename function mostly repeats the kernel's kbasename. This patch
simplifies it. The updated filename() will not check for the '\' in the
filenames. It seems redundant in Linux. The __FILE__ macro always defined if we
compile an existing file. Thus, NULL check is not needed there as well.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To quote the TODO from staging/net/:
PC300:
The driver is very broken and cannot work with the current TTY
layer. It is inevitable to convert it to the new TTY API. If no
one steps in to adopt the driver, it will be removed in the 3.7
release.
Nothing has changed since more than _one_ year on this driver, thus
just remove it since we already moved past 3.7. If somebody steps
up and does a whole rework, he/she, of course, is free to resubmit
it. Since this is the only one in the net directory, we can remove
it as well.
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The comedi_subdevice 'private' variable is a void * that is available
for the subdevice to use in manner. It's common in comedi drivers for
the driver to allocate memory for a subdevice and store the pointer
to that memory in the 'private' variable. It's then the responsibility
of the driver to free that memory when the device is detached.
Due to how the attach/detach works in comedi, the drivers need to do
some sanity checking before they can free the allocated memory during
the detach.
Introduce a helper function, comedi_spriv_free(), to handle freeing
the private data allocated for a subdevice. This allows moving all the
sanity checks into the helper function and makes it safe to call
with any context. It also allows removing some of the boilerplate
code in the (*detach) functions.
Remove the subdev_8255_cleanup() export in the 8255 subdevice driver
as well as the addi_watchdog_cleanup() export in the addi_watchdog
driver and use the new helper instead.
The amplc_dio200_common driver uses a number of local helper functions
to free the private data for it's subdevices. Remove those as well and
use the new helper.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
In the subdevice init during the attach of this driver, private data
is allocated for each subdevice. The pointer to this data is then
saved in the subdevice 's->private' so it can be free'ed during the
detach.
In __unioxx5_subdev_init() an error path exists that can happen before
the allocated pointer is saved in s->private. Make sure the allocated
memory is free'ed before returning the error.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Use the PLX 9052 register defines in plx9052.h instead of using
magic numbers for the register bits.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Add defines for the PLX 9052 CNTRL register defines and use them
instead of the magic numbers in the me4000 driver
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Use the PLX 9052 register defines in plx9052.h instead of duplicating
the defines locally in this driver.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Use the PLX 9052 register defines in plx9052.h instead of duplicating
the defines locally in this driver.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The PLX INTCSR register defines are a bit wordy and many of them
are not used anywhere.
For aesthetic reasons, remove all the *_MASK and *_DISABLED defines
and rename the remaining bit defines so they are not as wordy.
Convert all the bit defines to bit shifts.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This driver does not use anything in the plx9052.h header. Remove
the unnecessary include.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
cancel the work function at driver unload stage and remove
the function from the queue
Cc: Ben Chan <benchan@chromium.org>
Signed-off-by: Devendra Naga <devendra.aaru@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Pull x86 fixes from Ingo Molnar:
"Misc fixes"
* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/mm: Flush lazy MMU when DEBUG_PAGEALLOC is set
x86/mm/cpa/selftest: Fix false positive in CPA self test
x86/mm/cpa: Convert noop to functional fix
x86, mm: Patch out arch_flush_lazy_mmu_mode() when running on bare metal
x86, mm, paravirt: Fix vmalloc_fault oops during lazy MMU updates
Pull scheduler fixes from Ingo Molnar:
"Misc fixlets"
* 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
sched/cputime: Fix accounting on multi-threaded processes
sched/debug: Fix sd->*_idx limit range avoiding overflow
sched_clock: Prevent 64bit inatomicity on 32bit systems
sched: Convert BUG_ON()s in try_to_wake_up_local() to WARN_ON_ONCE()s
Pull drm fixes from Dave Airlie:
"One fix for a hotplug locking regressions, and one fix for an oops if
you unplug the monitor at an inopportune moment on the udl device."
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm/fb-helper: Fix locking in drm_fb_helper_hotplug_event
udl: handle EDID failure properly.
Pull m68knommu fix from Greg Ungerer:
"This contains only a single compilation fix for ColdFire m68k targets
that use local non-GPIOLIB support."
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu:
m68k: define a local gpio_request_one() function
Pull watchdog fix from Wim Van Sebroeck:
"It will fix compile errors for the at91rm9200_wdt driver"
* git://www.linux-watchdog.org/linux-watchdog:
watchdog: Revert the AT91RM9200_WATCHDOG dependency
Pull one more btrfs fix from Chris Mason:
"This has a recent fix from Josef for our tree log replay code. It
fixes problems where the inode counter for the number of bytes in the
file wasn't getting updated properly during fsync replay.
The commit did get rebased this morning, but it was only to clean up
the subject line. The code hasn't changed."
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
Btrfs: make sure nbytes are right after log replay
doing: echo 1234 | tee -a /sys/kernel/debug/tracing/set_ftrace_pid
Luckily, this can only be done by root, but still is a nasty bug.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQEcBAABAgAGBQJRaK2+AAoJEOdOSU1xswtMw48IAJPcSNMl1+epx5cPw8pwf+y6
YYvs/Ud3BMPBL+mpNPGNFWY+dWJsAtCtAgkLi0WgdL+b9iPNZrmQqqcP5xWV4uKV
vRX2SPCQcyEn5keNnFdN3fN1R0+Gj4V8kLvxPqugzNrO9EHejx+TJFWjrONzkcSy
g90lY45jfGWW0OS4GuSwHFhKDgcx8/kgb4Whv+xrKzTuX2QkU1BhG9WPsjiHWiL5
WRYjC4LWafrWaPd4cIkzMqj1eU/hL8BkiLLQHM1Tw8yD7t8OPzgmuJMZEh6Cx1iW
/Xrm5QkNEcqQ/vSAC6aWUi22VEgRYDLg8WjngwuMgY1Qa3LE2ex8cUDyk7lJbas=
=SFA8
-----END PGP SIGNATURE-----
Merge tag 'trace-fixes-v3.9-rc-v3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace
Pull ftrace fixes from Steven Rostedt:
"Namhyung Kim found and fixed a bug that can crash the kernel by simply
doing: echo 1234 | tee -a /sys/kernel/debug/tracing/set_ftrace_pid
Luckily, this can only be done by root, but still is a nasty bug."
* tag 'trace-fixes-v3.9-rc-v3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
ftrace: Move ftrace_filter_lseek out of CONFIG_DYNAMIC_FTRACE section
tracing: Fix possible NULL pointer dereferences
Nothing is using it yet, but this will allow us to delay the open-time
checks to use time, without breaking the normal UNIX permission
semantics where permissions are determined by the opener (and the file
descriptor can then be passed to a different process, or the process can
drop capabilities).
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Compiling the at91rm9200_wdt.c driver without at91rm9200
support was leading to several errors:
drivers/built-in.o: In function `at91_wdt_close':
at91_adc.c:(.text+0xc9fe4): undefined reference to `at91_st_base'
drivers/built-in.o: In function `at91_wdt_write':
at91_adc.c:(.text+0xca004): undefined reference to `at91_st_base'
drivers/built-in.o: In function `at91wdt_shutdown':
at91_adc.c:(.text+0xca01c): undefined reference to `at91_st_base'
drivers/built-in.o: In function `at91wdt_suspend':
at91_adc.c:(.text+0xca038): undefined reference to `at91_st_base'
drivers/built-in.o: In function `at91_wdt_open':
at91_adc.c:(.text+0xca0cc): undefined reference to `at91_st_base'
drivers/built-in.o:at91_adc.c:(.text+0xca2c8): more undefined references to
`at91_st_base' follow
So, reverting the modification of the "depends" Kconfig line
introduced by patch a6a1bcd37 (watchdog: at91rm9200: add DT support)
seems to be the good solution.
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Acked-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Revert commit 62a3ddef61 ("vfs: fix spinning prevention in prune_icache_sb").
This commit doesn't look right: since we are looking at the tail of the
list (sb->s_inode_lru.prev) if we want to skip an inode, we should put
it back at the head of the list instead of the tail, otherwise we will
keep spinning on it.
Discovered when investigating why prune_icache_sb came top in perf
reports of a swapping load.
Signed-off-by: Suleiman Souhlal <suleiman@google.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: stable@vger.kernel.org # v3.2+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Anatol Pomozov identified a race condition that hits module unloading
and re-loading. To quote Anatol:
"This is a race codition that exists between kset_find_obj() and
kobject_put(). kset_find_obj() might return kobject that has refcount
equal to 0 if this kobject is freeing by kobject_put() in other
thread.
Here is timeline for the crash in case if kset_find_obj() searches for
an object tht nobody holds and other thread is doing kobject_put() on
the same kobject:
THREAD A (calls kset_find_obj()) THREAD B (calls kobject_put())
splin_lock()
atomic_dec_return(kobj->kref), counter gets zero here
... starts kobject cleanup ....
spin_lock() // WAIT thread A in kobj_kset_leave()
iterate over kset->list
atomic_inc(kobj->kref) (counter becomes 1)
spin_unlock()
spin_lock() // taken
// it does not know that thread A increased counter so it
remove obj from list
spin_unlock()
vfree(module) // frees module object with containing kobj
// kobj points to freed memory area!!
kobject_put(kobj) // OOPS!!!!
The race above happens because module.c tries to use kset_find_obj()
when somebody unloads module. The module.c code was introduced in
commit 6494a93d55fa"
Anatol supplied a patch specific for module.c that worked around the
problem by simply not using kset_find_obj() at all, but rather than make
a local band-aid, this just fixes kset_find_obj() to be thread-safe
using the proper model of refusing the get a new reference if the
refcount has already dropped to zero.
See examples of this proper refcount handling not only in the kref
documentation, but in various other equivalent uses of this pattern by
grepping for atomic_inc_not_zero().
[ Side note: the module race does indicate that module loading and
unloading is not properly serialized wrt sysfs information using the
module mutex. That may require further thought, but this is the
correct fix at the kobject layer regardless. ]
Reported-analyzed-and-tested-by: Anatol Pomozov <anatol.pomozov@gmail.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
