From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org
Cc: mochel@digitalimplant.org
Subject: [PATCH] Driver Core: fix bk-driver-core kills ppc64
Date: Mon, 20 Jun 2005 15:59:27 -0700 [thread overview]
Message-ID: <11193083672817@kroah.com> (raw)
In-Reply-To: <1119308366638@kroah.com>
[PATCH] Driver Core: fix bk-driver-core kills ppc64
There's no check to see if the device is already bound to a driver, which
could do bad things. The first thing to go wrong is that it will try to match
a driver with a device already bound to one. In some cases (it appears with
USB with drivers/usb/core/usb.c::usb_match_id()), some drivers will match a
device based on the class type, so it would be common (especially for HID
devices) to match a device that is already bound.
The fun comes when ->probe() is called, it fails, then
driver_probe_device() does this:
dev->driver = NULL;
Later on, that pointer could be be dereferenced without checking and cause
hell to break loose.
This problem could be nasty. It's very hardware dependent, since some
devices could have a different set of matching qualifiers than others.
Now, I don't quite see exactly where/how you were getting that crash.
You're dereferencing bad memory, but I'm not sure which pointer was bad
and where it came from, but it could have come from a couple of different
places.
The patch below will hopefully fix it all up for you. It's against
2.6.12-rc2-mm1, and does the following:
- Move logic to driver_probe_device() and comments uncommon returns:
1 - If device is bound
0 - If device not bound, and no error
error - If there was an error.
- Move locking to caller of that function, since we want to lock a
device for the entire time we're trying to bind it to a driver (to
prevent against a driver being loaded at the same time).
- Update __device_attach() and __driver_attach() to do that locking.
- Check if device is already bound in __driver_attach()
- Update the converse device_release_driver() so it locks the device
around all of the operations.
- Mark driver_probe_device() as static and remove export. It's an
internal function, it should stay that way, and there are no other
callers. If there is ever a need to export it, we can audit it as
necessary.
Signed-off-by: Andrew Morton <akpm@osdl.org>
---
commit 0d3e5a2e39b6ba2974e9e7c2a429018c45de8e76
tree 30e584b73c356adce49dcc9df75332abaef95470
parent b86c1df1f98d16c999423a3907eb40a9423f481e
author Patrick Mochel <mochel@digitalimplant.org> Tue, 05 Apr 2005 23:46:33 -0700
committer Greg Kroah-Hartman <gregkh@suse.de> Mon, 20 Jun 2005 15:15:27 -0700
drivers/base/dd.c | 140 +++++++++++++++++++++++++-----------------------
include/linux/device.h | 1
2 files changed, 73 insertions(+), 68 deletions(-)
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -35,6 +35,8 @@
* nor take the bus's rwsem. Please verify those are accounted
* for before calling this. (It is ok to call with no other effort
* from a driver's probe() method.)
+ *
+ * This function must be called with @dev->sem held.
*/
void device_bind_driver(struct device * dev)
{
@@ -57,54 +59,56 @@ void device_bind_driver(struct device *
* because we don't know the format of the ID structures, nor what
* is to be considered a match and what is not.
*
- * If we find a match, we call @drv->probe(@dev) if it exists, and
- * call device_bind_driver() above.
+ *
+ * This function returns 1 if a match is found, an error if one
+ * occurs (that is not -ENODEV or -ENXIO), and 0 otherwise.
+ *
+ * This function must be called with @dev->sem held.
*/
-int driver_probe_device(struct device_driver * drv, struct device * dev)
+static int driver_probe_device(struct device_driver * drv, struct device * dev)
{
- int error = 0;
+ int ret = 0;
if (drv->bus->match && !drv->bus->match(dev, drv))
- return -ENODEV;
+ goto Done;
- down(&dev->sem);
+ pr_debug("%s: Matched Device %s with Driver %s\n",
+ drv->bus->name, dev->bus_id, drv->name);
dev->driver = drv;
if (drv->probe) {
- error = drv->probe(dev);
- if (error) {
+ ret = drv->probe(dev);
+ if (ret) {
dev->driver = NULL;
- up(&dev->sem);
- return error;
+ goto ProbeFailed;
}
}
- up(&dev->sem);
device_bind_driver(dev);
- return 0;
+ ret = 1;
+ pr_debug("%s: Bound Device %s to Driver %s\n",
+ drv->bus->name, dev->bus_id, drv->name);
+ goto Done;
+
+ ProbeFailed:
+ if (ret == -ENODEV || ret == -ENXIO) {
+ /* Driver matched, but didn't support device
+ * or device not found.
+ * Not an error; keep going.
+ */
+ ret = 0;
+ } else {
+ /* driver matched but the probe failed */
+ printk(KERN_WARNING
+ "%s: probe of %s failed with error %d\n",
+ drv->name, dev->bus_id, ret);
+ }
+ Done:
+ return ret;
}
static int __device_attach(struct device_driver * drv, void * data)
{
struct device * dev = data;
- int error;
-
- error = driver_probe_device(drv, dev);
- if (error) {
- if ((error == -ENODEV) || (error == -ENXIO)) {
- /* Driver matched, but didn't support device
- * or device not found.
- * Not an error; keep going.
- */
- error = 0;
- } else {
- /* driver matched but the probe failed */
- printk(KERN_WARNING
- "%s: probe of %s failed with error %d\n",
- drv->name, dev->bus_id, error);
- }
- return error;
- }
- /* stop looking, this device is attached */
- return 1;
+ return driver_probe_device(drv, dev);
}
/**
@@ -114,37 +118,43 @@ static int __device_attach(struct device
* Walk the list of drivers that the bus has and call
* driver_probe_device() for each pair. If a compatible
* pair is found, break out and return.
+ *
+ * Returns 1 if the device was bound to a driver; 0 otherwise.
*/
int device_attach(struct device * dev)
{
+ int ret = 0;
+
+ down(&dev->sem);
if (dev->driver) {
device_bind_driver(dev);
- return 1;
- }
-
- return bus_for_each_drv(dev->bus, NULL, dev, __device_attach);
+ ret = 1;
+ } else
+ ret = bus_for_each_drv(dev->bus, NULL, dev, __device_attach);
+ up(&dev->sem);
+ return ret;
}
static int __driver_attach(struct device * dev, void * data)
{
struct device_driver * drv = data;
- int error = 0;
- if (!dev->driver) {
- error = driver_probe_device(drv, dev);
- if (error) {
- if (error != -ENODEV) {
- /* driver matched but the probe failed */
- printk(KERN_WARNING
- "%s: probe of %s failed with error %d\n",
- drv->name, dev->bus_id, error);
- } else
- error = 0;
- return error;
- }
- /* stop looking, this driver is attached */
- return 1;
- }
+ /*
+ * Lock device and try to bind to it. We drop the error
+ * here and always return 0, because we need to keep trying
+ * to bind to devices and some drivers will return an error
+ * simply if it didn't support the device.
+ *
+ * driver_probe_device() will spit a warning if there
+ * is an error.
+ */
+
+ down(&dev->sem);
+ if (!dev->driver)
+ driver_probe_device(drv, dev);
+ up(&dev->sem);
+
+
return 0;
}
@@ -156,9 +166,6 @@ static int __driver_attach(struct device
* match the driver with each one. If driver_probe_device()
* returns 0 and the @dev->driver is set, we've found a
* compatible pair.
- *
- * Note that we ignore the -ENODEV error from driver_probe_device(),
- * since it's perfectly valid for a driver not to bind to any devices.
*/
void driver_attach(struct device_driver * drv)
{
@@ -176,19 +183,19 @@ void driver_attach(struct device_driver
*/
void device_release_driver(struct device * dev)
{
- struct device_driver * drv = dev->driver;
-
- if (!drv)
- return;
-
- sysfs_remove_link(&drv->kobj, kobject_name(&dev->kobj));
- sysfs_remove_link(&dev->kobj, "driver");
- klist_del(&dev->knode_driver);
+ struct device_driver * drv;
down(&dev->sem);
- if (drv->remove)
- drv->remove(dev);
- dev->driver = NULL;
+ if (dev->driver) {
+ drv = dev->driver;
+ sysfs_remove_link(&drv->kobj, kobject_name(&dev->kobj));
+ sysfs_remove_link(&dev->kobj, "driver");
+ klist_del(&dev->knode_driver);
+
+ if (drv->remove)
+ drv->remove(dev);
+ dev->driver = NULL;
+ }
up(&dev->sem);
}
@@ -208,7 +215,6 @@ void driver_detach(struct device_driver
}
-EXPORT_SYMBOL_GPL(driver_probe_device);
EXPORT_SYMBOL_GPL(device_bind_driver);
EXPORT_SYMBOL_GPL(device_release_driver);
EXPORT_SYMBOL_GPL(device_attach);
diff --git a/include/linux/device.h b/include/linux/device.h
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -325,7 +325,6 @@ extern int device_for_each_child(struct
* Manual binding of a device to driver. See drivers/base/bus.c
* for information on use.
*/
-extern int driver_probe_device(struct device_driver * drv, struct device * dev);
extern void device_bind_driver(struct device * dev);
extern void device_release_driver(struct device * dev);
extern int device_attach(struct device * dev);
next prev parent reply other threads:[~2005-06-21 2:45 UTC|newest]
Thread overview: 92+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-06-20 22:55 [GIT PATCH] Driver core changes for 2.6.12 Greg KH
2005-06-20 22:59 ` [PATCH] sysfs_{create|remove}_link should take const char * Greg KH
2005-06-20 22:59 ` [PATCH] kobject_hotplug() should use kobject_name() Greg KH
2005-06-20 22:59 ` [PATCH] Make kobject's name be const char * Greg KH
2005-06-20 22:59 ` [PATCH] kset_hotplug_ops->name shoudl return " Greg KH
2005-06-20 22:59 ` [PATCH] make driver's name be " Greg KH
2005-06-20 22:59 ` [PATCH] Make attributes names " Greg KH
2005-06-20 22:59 ` [PATCH] sysfs: (driver/base) if show/store is missing return -EIO Greg KH
2005-06-20 22:59 ` [PATCH] sysfs: " Greg KH
2005-06-20 22:59 ` [PATCH] sysfs: (driver/pci) " Greg KH
2005-06-20 22:59 ` [PATCH] sysfs: (driver/block) " Greg KH
2005-06-20 22:59 ` [PATCH] sysfs: (rest) " Greg KH
2005-06-20 22:59 ` [PATCH] INPUT: move to use the new class code, instead of class_simple Greg KH
2005-06-20 22:59 ` [PATCH] tty: " Greg KH
2005-06-20 22:59 ` [PATCH] CLASS: move a "simple" class logic into the class core Greg KH
2005-06-20 22:59 ` [PATCH] class: convert sound/* to use the new class api instead of class_simple Greg KH
2005-06-20 22:59 ` [PATCH] USB: move the usb hcd code to use the new class code Greg KH
2005-06-20 22:59 ` [PATCH] class: convert drivers/block/* to use the new class api instead of class_simple Greg KH
2005-06-20 22:59 ` [PATCH] class: convert drivers/ieee1394/* " Greg KH
2005-06-20 22:59 ` [PATCH] class: convert drivers/char/* " Greg KH
2005-06-20 22:59 ` [PATCH] class: convert drivers/scsi/* " Greg KH
2005-06-20 22:59 ` [PATCH] class: convert drivers/* " Greg KH
2005-06-20 22:59 ` [PATCH] USB: trivial error path fix Greg KH
2005-06-20 22:59 ` [PATCH] class: convert arch/* to use the new class api instead of class_simple Greg KH
2005-06-20 22:59 ` [PATCH] class: convert the remaining class_simple users in the kernel to usee the new class api Greg KH
2005-06-20 22:59 ` [PATCH] class: add kerneldoc for the new class functions Greg KH
2005-06-20 22:59 ` [PATCH] class: remove class_simple code, as no one in the tree is using it anymore Greg KH
2005-06-20 22:59 ` [PATCH] fix "make mandocs" after class_simple.c removal Greg KH
2005-06-20 22:59 ` [PATCH] Add a semaphore to struct device to synchronize calls to its driver Greg KH
2005-06-20 22:59 ` [PATCH] fix up ipmi code after class_simple.c removal Greg KH
2005-06-20 22:59 ` [PATCH] Move device/driver code to drivers/base/dd.c Greg KH
2005-06-20 22:59 ` [PATCH] Use driver_for_each_device() instead of manually walking list Greg KH
2005-06-20 22:59 ` [PATCH] Use driver_for_each_device() in drivers/pnp/driver.c " Greg KH
2005-06-20 22:59 ` [PATCH] Add driver_for_each_device() Greg KH
2005-06-20 22:59 ` [PATCH] Add a klist to struct bus_type for its drivers Greg KH
2005-06-20 22:59 ` [PATCH] Add a klist to struct bus_type for its devices Greg KH
2005-06-20 22:59 ` [PATCH] Add initial implementation of klist helpers Greg KH
2005-06-20 22:59 ` [PATCH] Add a klist to struct device_driver for the devices bound to it Greg KH
2005-06-20 22:59 ` [PATCH] Remove the unused device_find() Greg KH
2005-06-20 22:59 ` [PATCH] Use bus_for_each_{dev,drv} for driver binding Greg KH
2005-06-20 22:59 ` [PATCH] add klist_node_attached() to determine if a node is on a list or not Greg KH
2005-06-20 22:59 ` [PATCH] Fix up USB to use klist_node_attached() instead of list_empty() on lists that will go away Greg KH
2005-06-20 22:59 ` [PATCH] Remove struct device::driver_list Greg KH
2005-06-20 22:59 ` [PATCH] Fix up bus code and remove use of rwsem Greg KH
2005-06-20 22:59 ` [PATCH] Remove struct device::bus_list Greg KH
2005-06-20 22:59 ` [PATCH] Don't reference NULL klist pointer in klist_remove() Greg KH
2005-06-20 22:59 ` [PATCH] Call klist_del() instead of klist_remove() Greg KH
2005-06-20 22:59 ` [PATCH] Use device_for_each_child() to unregister devices in scsi_remove_target() Greg KH
2005-06-20 22:59 ` [PATCH] use device_for_each_child() to properly access child devices Greg KH
2005-06-20 22:59 ` [PATCH] Use a klist for device child lists Greg KH
2005-06-20 22:59 ` [PATCH] Fix up bogus comment Greg KH
2005-06-20 22:59 ` [PATCH] driver core: change export symbol for driver_for_each_device() Greg KH
2005-06-20 22:59 ` [PATCH] Use device_for_each_child() to unregister devices in nodemgr_remove_host_dev() Greg KH
2005-06-20 22:59 ` [PATCH] use device_for_each_child() to properly access child devices Greg KH
2005-06-20 22:59 ` [PATCH] USB: fix build warning in usb core as pointed out by Andrew Greg KH
2005-06-20 22:59 ` Greg KH [this message]
2005-06-20 22:59 ` [PATCH] Fix typo in scdrv_init() Greg KH
2005-06-20 22:59 ` [PATCH] Driver core: Fix up the driver and device iterators to be quieter Greg KH
2005-06-20 22:59 ` [PATCH] usb: klist_node_attached() fix Greg KH
2005-06-20 22:59 ` [PATCH] sn: fixes due to driver core changes Greg KH
2005-06-20 22:59 ` [PATCH] driver core: Fix races in driver_detach() Greg KH
2005-06-20 22:59 ` [PATCH] Driver Core: driver model doc update Greg KH
2005-06-20 22:59 ` [PATCH] Driver core: unregister_node() for hotplug use Greg KH
2005-06-20 22:59 ` [PATCH] usbcore: Don't call device_release_driver recursively Greg KH
2005-06-20 22:59 ` [PATCH] libfs: add simple attribute files Greg KH
2005-06-20 22:59 ` [PATCH] Driver core: change device_attribute callbacks Greg KH
2005-06-20 22:59 ` [PATCH] driver core: fix error handling in bus_add_device Greg KH
2005-06-20 22:59 ` [PATCH] Driver core: Documentation: update device attribute callbacks Greg KH
2005-06-20 22:59 ` [PATCH] Driver Core: drivers/base - drivers/i2c/chips/adm1026.c: " Greg KH
2005-06-20 22:59 ` [PATCH] Driver Core: arch: " Greg KH
2005-06-20 22:59 ` [PATCH] Driver Core: drivers/i2c/chips/adm1031.c - lm75.c: " Greg KH
2005-06-20 22:59 ` [PATCH] Driver Core: drivers/i2c/chips/lm77.c - max1619.c: " Greg KH
2005-06-20 22:59 ` [PATCH] Driver Core: drivers/i2c/chips/pc87360.c - w83627hf.c: " Greg KH
2005-06-20 22:59 ` [PATCH] Driver Core: drivers/char/raw3270.c - drivers/net/netiucv.c: " Greg KH
2005-06-20 22:59 ` [PATCH] Driver Core: drivers/i2c/chips/w83781d.c - drivers/s390/block/dcssblk.c: " Greg KH
2005-06-20 22:59 ` [PATCH] Driver Core: drivers/usb/input/aiptek.c - drivers/zorro/zorro-sysfs.c: " Greg KH
2005-06-20 22:59 ` [PATCH] Driver Core: drivers/s390/net/qeth_sys.c - drivers/usb/gadget/pxa2xx_udc.c: " Greg KH
2005-06-20 22:59 ` [PATCH] Driver Core: include: " Greg KH
2005-06-20 22:59 ` [PATCH] I2C: drivers/i2c/chips/adm1026.c: use dynamic sysfs callbacks Greg KH
2005-06-20 22:59 ` [PATCH] I2C: add i2c sensor_device_attribute and macros Greg KH
2005-06-20 22:59 ` [PATCH] sysfs-iattr: attach sysfs_dirent before new inode Greg KH
2005-06-20 22:59 ` [PATCH] Driver core: Don't "lose" devices on suspend on failure Greg KH
2005-06-20 22:59 ` [PATCH] sysfs-iattr: set inode attributes Greg KH
2005-06-20 22:59 ` [PATCH] sysfs-iattr: add sysfs_setattr Greg KH
2005-06-20 22:59 ` [PATCH] SYSFS: fix PAGE_SIZE check Greg KH
2005-06-20 22:59 ` [PATCH] USB: fix show_modalias() function due to attribute change Greg KH
2005-06-20 22:59 ` [PATCH] PCI: " Greg KH
2005-07-06 0:38 ` [PATCH] Use device_for_each_child() to unregister devices in scsi_remove_target() Patrick Mansfield
2005-07-12 0:20 ` Greg KH
2005-07-12 0:56 ` Patrick Mansfield
2005-06-21 11:42 ` [PATCH] Add initial implementation of klist helpers Rik van Riel
2005-06-21 23:13 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=11193083672817@kroah.com \
--to=gregkh@suse.de \
--cc=greg@kroah.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mochel@digitalimplant.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.