bybrooklyn/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-04-18 06:44:00 -04:00
Code Issues Packages Projects Releases Wiki Activity

rpmsg: Fix calling device_lock() on non-initialized device

Browse Source 
driver_set_override() helper uses device_lock() so it should not be
called before rpmsg_register_device() (which calls device_register()).
Effect can be seen with CONFIG_DEBUG_MUTEXES:

  DEBUG_LOCKS_WARN_ON(lock->magic != lock)
  WARNING: CPU: 3 PID: 57 at kernel/locking/mutex.c:582 __mutex_lock+0x1ec/0x430
  ...
  Call trace:
   __mutex_lock+0x1ec/0x430
   mutex_lock_nested+0x44/0x50
   driver_set_override+0x124/0x150
   qcom_glink_native_probe+0x30c/0x3b0
   glink_rpm_probe+0x274/0x350
   platform_probe+0x6c/0xe0
   really_probe+0x17c/0x3d0
   __driver_probe_device+0x114/0x190
   driver_probe_device+0x3c/0xf0
   ...

Refactor the rpmsg_register_device() function to use two-step device
registering (initialization + add) and call driver_set_override() in
proper moment.

This moves the code around, so while at it also NULL-ify the
rpdev->driver_override in error path to be sure it won't be kfree()
second time.

Fixes: 42cd402b8f ("rpmsg: Fix kfree() of static memory on setting driver_override")
Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20220429195946.1061725-2-krzysztof.kozlowski@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Krzysztof Kozlowski
2022-04-29 21:59:45 +02:00
committed by Greg Kroah-Hartman
parent 6370b04f24
commit bb17d110cb
4 changed files with 40 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
drivers/rpmsg/rpmsg_core.c
View File

@@ -593,24 +593,51 @@ static struct bus_type rpmsg_bus = {
.remove = rpmsg_dev_remove,
};
int rpmsg_register_device(struct rpmsg_device *rpdev)
/*
* A helper for registering rpmsg device with driver override and name.
* Drivers should not be using it, but instead rpmsg_register_device().
*/
int rpmsg_register_device_override(struct rpmsg_device *rpdev,
const char *driver_override)
{
struct device *dev = &rpdev->dev;
int ret;
if (driver_override)
strcpy(rpdev->id.name, driver_override);
dev_set_name(&rpdev->dev, "%s.%s.%d.%d", dev_name(dev->parent),
rpdev->id.name, rpdev->src, rpdev->dst);
rpdev->dev.bus = &rpmsg_bus;
ret = device_register(&rpdev->dev);
device_initialize(dev);
if (driver_override) {
ret = driver_set_override(dev, &rpdev->driver_override,
driver_override,
strlen(driver_override));
if (ret) {
dev_err(dev, "device_set_override failed: %d\n", ret);
return ret;
}
}
ret = device_add(dev);
if (ret) {
dev_err(dev, "device_register failed: %d\n", ret);
dev_err(dev, "device_add failed: %d\n", ret);
kfree(rpdev->driver_override);
rpdev->driver_override = NULL;
put_device(&rpdev->dev);
}
return ret;
}
EXPORT_SYMBOL(rpmsg_register_device_override);
int rpmsg_register_device(struct rpmsg_device *rpdev)
{
return rpmsg_register_device_override(rpdev, NULL);
}
EXPORT_SYMBOL(rpmsg_register_device);
/*