Srinivas Kandagatla 1ed6871464 of: platform: stop accessing invalid dev in of_platform_device_destroy ... commit 522811e944 upstream. Immediately after the platform_device_unregister() the device will be cleaned up. Accessing the freed pointer immediately after that will crash the system. Found this bug when kernel is built with CONFIG_PAGE_POISONING and testing loading/unloading audio drivers in a loop on Qcom platforms. Fix this by moving of_node_clear_flag() just before the unregister calls. Below is the crash trace: Unable to handle kernel paging request at virtual address 6b6b6b6b6b6c03 Mem abort info: ESR = 0x96000021 Exception class = DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000021 CM = 0, WnR = 0 [006b6b6b6b6b6c03] address between user and kernel address ranges Internal error: Oops: 96000021 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 1784 Comm: sh Tainted: G W 4.17.0-rc7-02230-ge3a63a7ef641-dirty #204 Hardware name: Qualcomm Technologies, Inc. APQ 8016 SBC (DT) pstate: 80000005 (Nzcv daif -PAN -UAO) pc : clear_bit+0x18/0x2c lr : of_platform_device_destroy+0x64/0xb8 sp : ffff00000c9c3930 x29: ffff00000c9c3930 x28: ffff80003d39b200 x27: ffff000008bb1000 x26: 0000000000000040 x25: 0000000000000124 x24: ffff80003a9a3080 x23: 0000000000000060 x22: ffff00000939f518 x21: ffff80003aa79e98 x20: ffff80003aa3dae0 x19: ffff80003aa3c890 x18: ffff800009feb794 x17: 0000000000000000 x16: 0000000000000000 x15: ffff800009feb790 x14: 0000000000000000 x13: ffff80003a058778 x12: ffff80003a058728 x11: ffff80003a058750 x10: 0000000000000000 x9 : 0000000000000006 x8 : ffff80003a825988 x7 : bbbbbbbbbbbbbbbb x6 : 0000000000000001 x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000008 x2 : 0000000000000001 x1 : 6b6b6b6b6b6b6c03 x0 : 0000000000000000 Process sh (pid: 1784, stack limit = 0x (ptrval)) Call trace: clear_bit+0x18/0x2c q6afe_remove+0x20/0x38 apr_device_remove+0x30/0x70 device_release_driver_internal+0x170/0x208 device_release_driver+0x14/0x20 bus_remove_device+0xcc/0x150 device_del+0x10c/0x310 device_unregister+0x1c/0x70 apr_remove_device+0xc/0x18 device_for_each_child+0x50/0x80 apr_remove+0x18/0x20 rpmsg_dev_remove+0x38/0x68 device_release_driver_internal+0x170/0x208 device_release_driver+0x14/0x20 bus_remove_device+0xcc/0x150 device_del+0x10c/0x310 device_unregister+0x1c/0x70 qcom_smd_remove_device+0xc/0x18 device_for_each_child+0x50/0x80 qcom_smd_unregister_edge+0x3c/0x70 smd_subdev_remove+0x18/0x28 rproc_stop+0x48/0xd8 rproc_shutdown+0x60/0xe8 state_store+0xbc/0xf8 dev_attr_store+0x18/0x28 sysfs_kf_write+0x3c/0x50 kernfs_fop_write+0x118/0x1e0 __vfs_write+0x18/0x110 vfs_write+0xa4/0x1a8 ksys_write+0x48/0xb0 sys_write+0xc/0x18 el0_svc_naked+0x30/0x34 Code: d2800022 8b400c21 f9800031 9ac32043 (c85f7c22) ---[ end trace 32020935775616a2 ]--- Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Cc: stable@vger.kernel.org Signed-off-by: Rob Herring <robh@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-07-03 11:24:52 +02:00
..
unittest-data	.gitignore: move *.dtb and *.dtb.S patterns to the top-level .gitignore	2018-02-13 10:19:46 +01:00
Kconfig	mtd: Kill the OF_MTD Kconfig option	2016-09-23 09:35:16 +02:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
address.c	of: remove unused pci_space variable from address.c	2017-07-21 10:46:15 -05:00
base.c	of: do not leak console options	2017-10-12 12:22:04 -05:00
device.c	dma-mapping updates for 4.14:	2017-09-12 13:30:06 -07:00
dynamic.c	of: Convert to using %pOF instead of full_name	2017-07-18 17:09:18 -05:00
fdt.c	earlycon: Use a pointer table to fix __earlycon_table stride	2018-05-01 12:58:24 -07:00
fdt_address.c	of: use pr_fmt prefix for all console printing	2016-07-18 16:57:42 -05:00
irq.c	DeviceTree updates for 4.14:	2017-09-07 14:43:33 -07:00
of_mdio.c	of_mdio: avoid MDIO bus removal when a PHY is missing	2018-03-03 10:24:37 +01:00
of_net.c	of_net: factor out repetitive code from of_get_mac_address()	2015-03-29 08:56:17 +01:00
of_numa.c	of: fix "/cpus" reference leak in of_numa_parse_cpu_nodes()	2017-04-18 11:04:12 -05:00
of_pci.c	of_pci: use of_property_read_u32_array()	2017-07-24 10:00:52 -05:00
of_pci_irq.c	OF/PCI: Update of_irq_parse_and_map_pci() comment	2017-07-02 16:14:28 -05:00
of_private.h	of: find_node_by_full_name rewrite to compare each level	2017-06-22 12:38:29 -05:00
of_reserved_mem.c	drivers: of: increase MAX_RESERVED_REGIONS to 32	2017-10-12 12:23:45 -05:00
overlay.c	of: overlay: add overlay symbols to live device tree	2017-07-20 09:40:05 -05:00
pdt.c	of: Eliminate of_allnodes list	2014-11-04 13:29:38 +00:00
platform.c	of: platform: stop accessing invalid dev in of_platform_device_destroy	2018-07-03 11:24:52 +02:00
property.c	device property: preserve usecount for node passed to of_fwnode_graph_get_port_parent()	2017-10-12 12:26:14 -05:00
resolver.c	of: overlay: validate offset from property fixups	2018-07-03 11:24:52 +02:00
unittest.c	of: unittest: for strings, account for trailing \0 in property length field	2018-07-03 11:24:52 +02:00