From: Tilman Schmidt <tilman@imap.cc>
To: Paul Bolle <pebolle@tiscali.nl>,
Peter Hurley <peter@hurleysoftware.com>,
Sasha Levin <sasha.levin@oracle.com>
Cc: isdn@linux-pingi.de, davem@davemloft.net,
gigaset307x-common@lists.sourceforge.net,
LKML <linux-kernel@vger.kernel.org>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
syzkaller <syzkaller@googlegroups.com>
Subject: Re: gigaset: freeing an active object
Date: Sun, 6 Dec 2015 16:29:32 +0100 [thread overview]
Message-ID: <5664545C.90607@imap.cc> (raw)
In-Reply-To: <1449408690.2515.15.camel@tiscali.nl>
[-- Attachment #1: Type: text/plain, Size: 3207 bytes --]
Am 06.12.2015 um 14:31 schrieb Paul Bolle:
> On wo, 2015-12-02 at 18:48 -0500, Peter Hurley wrote:
>> On 11/30/2015 01:01 PM, Paul Bolle wrote:
>>> --- a/drivers/isdn/gigaset/ser-gigaset.c
>>> +++ b/drivers/isdn/gigaset/ser-gigaset.c
>>> @@ -42,8 +42,9 @@ MODULE_PARM_DESC(cidmode, "stay in CID mode when
>>> idle");
>>>
>>> static struct gigaset_driver *driver;
>>>
>>> +static struct platform_device pdev;
>>> +
>>> struct ser_cardstate {
>>> - struct platform_device dev;
>>> struct tty_struct *tty;
>>> atomic_t refcnt;
>>> struct completion dead_cmp;
>>> @@ -370,8 +371,8 @@ static void gigaset_freecshw(struct cardstate
>>> *cs)
>>> tasklet_kill(&cs->write_tasklet);
>>> if (!cs->hw.ser)
>>> return;
>>> - dev_set_drvdata(&cs->hw.ser->dev.dev, NULL);
>>> - platform_device_unregister(&cs->hw.ser->dev);
>>> + dev_set_drvdata(&pdev.dev, NULL);
>>> + platform_device_unregister(&pdev);
>>> kfree(cs->hw.ser);
>>
>> Tilman,
>>
>> Is there a 1:1 correspondence and lifetime for the embedded platform
>> device and it's containing memory?
>
> (Haven't heard from Tilman, so I'll give this a try.)
Sorry for that. Been busy.
> That containing memory is a struct ser_cardstate. And currently
> instances of struct _ser_cardstate are malloced and freed in routines
> that also call platform_device_register() and
> platform_device_unregister(). So yes, I think there's a 1:1
> correspondence.
Correct.
>> I ask because the typical approach for device teardown is to put the
>> kfree() in the release method;
>
> (Side note: the (struct device) release method of this driver
> -gigaset_device_release() - is actually a nop. It only frees device
> ->platform_data and platform_device->resource, but neither are actually
> used: they remain NULL through their entire life.)
Yeah, that was just copied unthinkingly from driver/base/platform.c.
So the solution might be as simple as moving the kfree() call from
gigaset_freecshw() to gigaset_device_release(). Something like this:
--- a/drivers/isdn/gigaset/ser-gigaset.c
+++ b/drivers/isdn/gigaset/ser-gigaset.c
@@ -370,19 +370,18 @@ static void gigaset_freecshw(struct cardstate *cs)
tasklet_kill(&cs->write_tasklet);
if (!cs->hw.ser)
return;
- dev_set_drvdata(&cs->hw.ser->dev.dev, NULL);
platform_device_unregister(&cs->hw.ser->dev);
- kfree(cs->hw.ser);
- cs->hw.ser = NULL;
}
static void gigaset_device_release(struct device *dev)
{
- struct platform_device *pdev = to_platform_device(dev);
+ struct cardstate *cs = dev_get_drvdata(dev);
- /* adapted from platform_device_release() in
drivers/base/platform.c */
- kfree(dev->platform_data);
- kfree(pdev->resource);
+ if (!cs)
+ return;
+ dev_set_drvdata(dev, NULL);
+ kfree(cs->hw.ser);
+ cs->hw.ser = NULL;
}
/*
(Off the top of my hat, completely untested, don't even know if that
will compile.)
--
Tilman Schmidt E-Mail: tilman@imap.cc
Bonn, Germany
Nous, on a des fleurs et des bougies pour nous protéger.
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 473 bytes --]
next prev parent reply other threads:[~2015-12-06 15:29 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-11-27 15:19 gigaset: freeing an active object Sasha Levin
2015-11-27 17:57 ` Paul Bolle
2015-11-27 18:15 ` Sasha Levin
2015-11-28 0:28 ` Paul Bolle
2015-11-28 1:20 ` Peter Hurley
2015-11-28 1:27 ` Sasha Levin
2015-11-29 14:36 ` Dmitry Vyukov
2015-11-29 15:30 ` Tilman Schmidt
2015-11-29 18:22 ` Peter Hurley
2015-11-29 18:38 ` Tilman Schmidt
2015-11-29 18:47 ` Tilman Schmidt
2015-11-29 20:26 ` Paul Bolle
2015-11-29 23:23 ` Paul Bolle
2015-11-29 23:23 ` Paul Bolle
2015-11-30 18:01 ` Paul Bolle
2015-11-30 18:30 ` Tilman Schmidt
2015-11-30 21:07 ` Paul Bolle
2015-12-01 9:30 ` Tilman Schmidt
2015-12-01 10:05 ` Paul Bolle
2015-12-02 23:48 ` Peter Hurley
2015-12-06 13:31 ` Paul Bolle
2015-12-06 15:29 ` Tilman Schmidt [this message]
2015-12-06 20:12 ` Paul Bolle
2015-12-07 9:27 ` Tilman Schmidt
2015-12-07 12:25 ` Paul Bolle
2015-12-07 18:40 ` Tilman Schmidt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5664545C.90607@imap.cc \
--to=tilman@imap.cc \
--cc=davem@davemloft.net \
--cc=gigaset307x-common@lists.sourceforge.net \
--cc=isdn@linux-pingi.de \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pebolle@tiscali.nl \
--cc=peter@hurleysoftware.com \
--cc=sasha.levin@oracle.com \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.