From: Peter Tyser <ptyser@xes-inc.com>
To: Samuel Ortiz <sameo@linux.intel.com>
Cc: Paul Bolle <pebolle@tiscali.nl>, linux-kernel@vger.kernel.org
Subject: Re: mfd: lpc_ich: NULL pointer dereference at (second) module removal
Date: Mon, 19 Nov 2012 09:30:31 -0600 [thread overview]
Message-ID: <1353339031.27201.7.camel@petert> (raw)
In-Reply-To: <20121119002404.GD18738@sortiz-mobl>
Hi Samuel,
> > On Fri, 2012-11-09 at 14:19 +0100, Paul Bolle wrote:
> > > 0) I can trigger a NULL pointer dereference if I remove the lpc_ich
> > > module. This seems to only happen if I remove it for the second time
> > > (ie, remove the module, insert it and remove it again). This happens
> > > both on i686 and x86_64 (different setups, as inserting the module
> > > triggers different messages about the initialization of the MFD cells on
> > > these machines). Both machines are running v3.6.6.
> >
> > I believe this is caused by the fact that non-MFD devices get attached
> > to the same parent as the iTCO_wdt driver, which is an MFD. When the
> > MFD code attempts unregister the MFD drivers, it oops when the non-MFD
> > devices are accessed since they don't have the mfd_cell node.
> That's probably correct. I just merged commit
> 5dc4dda91c86ef82bd53d77e5de50ec095b33e46 into my for-next branch and that one
> could fix that issue. Could you guys please give it a go ? This is the actual
> patch:
>
> From 5dc4dda91c86ef82bd53d77e5de50ec095b33e46 Mon Sep 17 00:00:00 2001
> From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
> Date: Fri, 9 Nov 2012 16:15:28 +0000
> Subject: [PATCH] mfd: Only unregister platform devices allocated by the mfd
> core
>
> mfd_remove_devices would iterate over all devices sharing a parent with
> an mfd device regardless of whether they were allocated by the mfd core
> or not. This especially caused problems when the device structure was
> not contained within a platform_device, because to_platform_device is
> used on each device pointer.
>
> This patch defines a device_type for mfd devices and checks this is
> present from mfd_remove_devices_fn before processing the device.
>
> Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
> Reviewed-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Tested-by: Peter Tyser <ptyser@xes-inc.com>
Looks good to me.
Best,
Peter
prev parent reply other threads:[~2012-11-19 15:31 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-11-09 13:19 mfd: lpc_ich: NULL pointer dereference at (second) module removal Paul Bolle
2012-11-12 17:31 ` Peter Tyser
2012-11-19 0:24 ` Samuel Ortiz
2012-11-19 13:02 ` Paul Bolle
2012-11-19 17:34 ` Samuel Ortiz
2012-11-19 15:30 ` Peter Tyser [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1353339031.27201.7.camel@petert \
--to=ptyser@xes-inc.com \
--cc=linux-kernel@vger.kernel.org \
--cc=pebolle@tiscali.nl \
--cc=sameo@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.