[PATCH] regulator: core: Move regulator release to avoid deadlock

[PATCH] regulator: core: Move regulator release to avoid deadlock

[Charles Keepax]

regulator_put function was called whilst holding the
regulator_list_mutex, which is also locked from regulator_put. This
causes deadlock when failing to register a regulator.

This patch adds a second exit point for the regulator_register function
which releases the mutex and then cleans up the supply.

Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
---
 drivers/regulator/core.c |    9 ++++++---
 1 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 5c4829c..e68754c 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -3444,15 +3444,18 @@ unset_supplies:
 	unset_regulator_supplies(rdev);
 
 scrub:
-	if (rdev->supply)
-		regulator_put(rdev->supply);
 	if (rdev->ena_gpio)
 		gpio_free(rdev->ena_gpio);
 	kfree(rdev->constraints);
 	device_unregister(&rdev->dev);
+
+	mutex_unlock(&regulator_list_mutex);
+	if (rdev->supply)
+		regulator_put(rdev->supply);
+
 	/* device core frees rdev */
 	rdev = ERR_PTR(ret);
-	goto out;
+	return rdev;
 
 clean:
 	kfree(rdev);
-- 
1.7.2.5

Re: [PATCH] regulator: core: Move regulator release to avoid deadlock

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 263 bytes --]

On Mon, Oct 29, 2012 at 09:33:33AM +0000, Charles Keepax wrote:
> regulator_put function was called whilst holding the
> regulator_list_mutex, which is also locked from regulator_put. This
> causes deadlock when failing to register a regulator.

Applied, thanks.

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 836 bytes --]

Re: [PATCH] regulator: core: Move regulator release to avoid deadlock

[Laxman Dewangan]

On Monday 29 October 2012 09:44 PM, Mark Brown wrote:
> * PGP Signed by an unknown key
>
> On Mon, Oct 29, 2012 at 09:33:33AM +0000, Charles Keepax wrote:
>> regulator_put function was called whilst holding the
>> regulator_list_mutex, which is also locked from regulator_put. This
>> causes deadlock when failing to register a regulator.
> Applied, thanks.

This patch create the crash in following case:
- If there is of rail supply and supply does not found. In this case it 
goes to scrub and rdev->supply at this point shows NULL but when call 
the function device_unregister(&rdev->dev), the rdev->supply becomes 
random pointer.

What happen if we do the device_unregister() outside the mutex lock?

Re: [PATCH] regulator: core: Move regulator release to avoid deadlock

[Charles Keepax]

On Wed, Oct 31, 2012 at 04:03:59PM +0530, Laxman Dewangan wrote:
> On Monday 29 October 2012 09:44 PM, Mark Brown wrote:
>> * PGP Signed by an unknown key
>>
>> On Mon, Oct 29, 2012 at 09:33:33AM +0000, Charles Keepax wrote:
>>> regulator_put function was called whilst holding the
>>> regulator_list_mutex, which is also locked from regulator_put. This
>>> causes deadlock when failing to register a regulator.
>> Applied, thanks.
>
> This patch create the crash in following case:
> - If there is of rail supply and supply does not found. In this case it  
> goes to scrub and rdev->supply at this point shows NULL but when call  
> the function device_unregister(&rdev->dev), the rdev->supply becomes  
> random pointer.

Yeah that is a problem, sorry for missing this.

>
> What happen if we do the device_unregister() outside the mutex lock?

It would look reasonable to me, but I think it is going to make
more sense for someone with more experience than myself to have a
closer look at what can be done.