w1_therm reference count family data
A temperature conversion can take 750 ms and when possible the w1_therm slave driver drops the bus_mutex to allow other bus operations, but that includes operations such as a periodic slave search, which can remove this slave when it is no longer detected. If that happens the sl->family_data will be freed and set to NULL causing w1_slave_show to crash when it wakes up. Signed-off-by: David Fries <David@Fries.net> Reported-By: Thorsten Bschorr <thorsten@bschorr.de> Tested-by: Thorsten Bschorr <thorsten@bschorr.de> Acked-by: Evgeniy Polyakov <zbr@ioremap.net> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
c309835692
commit
f7134eea05
|
@ -59,16 +59,32 @@ MODULE_ALIAS("w1-family-" __stringify(W1_THERM_DS28EA00));
|
||||||
static int w1_strong_pullup = 1;
|
static int w1_strong_pullup = 1;
|
||||||
module_param_named(strong_pullup, w1_strong_pullup, int, 0);
|
module_param_named(strong_pullup, w1_strong_pullup, int, 0);
|
||||||
|
|
||||||
|
struct w1_therm_family_data {
|
||||||
|
uint8_t rom[9];
|
||||||
|
atomic_t refcnt;
|
||||||
|
};
|
||||||
|
|
||||||
|
/* return the address of the refcnt in the family data */
|
||||||
|
#define THERM_REFCNT(family_data) \
|
||||||
|
(&((struct w1_therm_family_data*)family_data)->refcnt)
|
||||||
|
|
||||||
static int w1_therm_add_slave(struct w1_slave *sl)
|
static int w1_therm_add_slave(struct w1_slave *sl)
|
||||||
{
|
{
|
||||||
sl->family_data = kzalloc(9, GFP_KERNEL);
|
sl->family_data = kzalloc(sizeof(struct w1_therm_family_data),
|
||||||
|
GFP_KERNEL);
|
||||||
if (!sl->family_data)
|
if (!sl->family_data)
|
||||||
return -ENOMEM;
|
return -ENOMEM;
|
||||||
|
atomic_set(THERM_REFCNT(sl->family_data), 1);
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
static void w1_therm_remove_slave(struct w1_slave *sl)
|
static void w1_therm_remove_slave(struct w1_slave *sl)
|
||||||
{
|
{
|
||||||
|
int refcnt = atomic_sub_return(1, THERM_REFCNT(sl->family_data));
|
||||||
|
while(refcnt) {
|
||||||
|
msleep(1000);
|
||||||
|
refcnt = atomic_read(THERM_REFCNT(sl->family_data));
|
||||||
|
}
|
||||||
kfree(sl->family_data);
|
kfree(sl->family_data);
|
||||||
sl->family_data = NULL;
|
sl->family_data = NULL;
|
||||||
}
|
}
|
||||||
|
@ -194,13 +210,22 @@ static ssize_t w1_slave_show(struct device *device,
|
||||||
struct w1_slave *sl = dev_to_w1_slave(device);
|
struct w1_slave *sl = dev_to_w1_slave(device);
|
||||||
struct w1_master *dev = sl->master;
|
struct w1_master *dev = sl->master;
|
||||||
u8 rom[9], crc, verdict, external_power;
|
u8 rom[9], crc, verdict, external_power;
|
||||||
int i, max_trying = 10;
|
int i, ret, max_trying = 10;
|
||||||
ssize_t c = PAGE_SIZE;
|
ssize_t c = PAGE_SIZE;
|
||||||
|
u8 *family_data = sl->family_data;
|
||||||
|
|
||||||
i = mutex_lock_interruptible(&dev->bus_mutex);
|
ret = mutex_lock_interruptible(&dev->bus_mutex);
|
||||||
if (i != 0)
|
if (ret != 0)
|
||||||
return i;
|
goto post_unlock;
|
||||||
|
|
||||||
|
if(!sl->family_data)
|
||||||
|
{
|
||||||
|
ret = -ENODEV;
|
||||||
|
goto pre_unlock;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* prevent the slave from going away in sleep */
|
||||||
|
atomic_inc(THERM_REFCNT(family_data));
|
||||||
memset(rom, 0, sizeof(rom));
|
memset(rom, 0, sizeof(rom));
|
||||||
|
|
||||||
while (max_trying--) {
|
while (max_trying--) {
|
||||||
|
@ -230,17 +255,19 @@ static ssize_t w1_slave_show(struct device *device,
|
||||||
mutex_unlock(&dev->bus_mutex);
|
mutex_unlock(&dev->bus_mutex);
|
||||||
|
|
||||||
sleep_rem = msleep_interruptible(tm);
|
sleep_rem = msleep_interruptible(tm);
|
||||||
if (sleep_rem != 0)
|
if (sleep_rem != 0) {
|
||||||
return -EINTR;
|
ret = -EINTR;
|
||||||
|
goto post_unlock;
|
||||||
|
}
|
||||||
|
|
||||||
i = mutex_lock_interruptible(&dev->bus_mutex);
|
ret = mutex_lock_interruptible(&dev->bus_mutex);
|
||||||
if (i != 0)
|
if (ret != 0)
|
||||||
return i;
|
goto post_unlock;
|
||||||
} else if (!w1_strong_pullup) {
|
} else if (!w1_strong_pullup) {
|
||||||
sleep_rem = msleep_interruptible(tm);
|
sleep_rem = msleep_interruptible(tm);
|
||||||
if (sleep_rem != 0) {
|
if (sleep_rem != 0) {
|
||||||
mutex_unlock(&dev->bus_mutex);
|
ret = -EINTR;
|
||||||
return -EINTR;
|
goto pre_unlock;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -269,19 +296,24 @@ static ssize_t w1_slave_show(struct device *device,
|
||||||
c -= snprintf(buf + PAGE_SIZE - c, c, ": crc=%02x %s\n",
|
c -= snprintf(buf + PAGE_SIZE - c, c, ": crc=%02x %s\n",
|
||||||
crc, (verdict) ? "YES" : "NO");
|
crc, (verdict) ? "YES" : "NO");
|
||||||
if (verdict)
|
if (verdict)
|
||||||
memcpy(sl->family_data, rom, sizeof(rom));
|
memcpy(family_data, rom, sizeof(rom));
|
||||||
else
|
else
|
||||||
dev_warn(device, "Read failed CRC check\n");
|
dev_warn(device, "Read failed CRC check\n");
|
||||||
|
|
||||||
for (i = 0; i < 9; ++i)
|
for (i = 0; i < 9; ++i)
|
||||||
c -= snprintf(buf + PAGE_SIZE - c, c, "%02x ",
|
c -= snprintf(buf + PAGE_SIZE - c, c, "%02x ",
|
||||||
((u8 *)sl->family_data)[i]);
|
((u8 *)family_data)[i]);
|
||||||
|
|
||||||
c -= snprintf(buf + PAGE_SIZE - c, c, "t=%d\n",
|
c -= snprintf(buf + PAGE_SIZE - c, c, "t=%d\n",
|
||||||
w1_convert_temp(rom, sl->family->fid));
|
w1_convert_temp(rom, sl->family->fid));
|
||||||
|
ret = PAGE_SIZE - c;
|
||||||
|
|
||||||
|
pre_unlock:
|
||||||
mutex_unlock(&dev->bus_mutex);
|
mutex_unlock(&dev->bus_mutex);
|
||||||
|
|
||||||
return PAGE_SIZE - c;
|
post_unlock:
|
||||||
|
atomic_dec(THERM_REFCNT(family_data));
|
||||||
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
static int __init w1_therm_init(void)
|
static int __init w1_therm_init(void)
|
||||||
|
|
Loading…
Reference in a new issue