Re: [BUG][PATCH -mm] bluetooth : rfcomm add get/put device in del_conn

Dave Young
2007-12-26T03:13:00Z

On Tue, Dec 25, 2007 at 06:07:24PM +0800, Dave Young wrote:
> On Dec 25, 2007 6:03 PM, Dave Young <hidave.darkstar@gmail.com> wrote:
> > Due to 2.6.24-rc6-mm1 kernel changes (maybe kobject or driver core), If I exec:
> >
> > rfcomm connect 0 1
> >
> > kernel will oops after connect timeout.
> >
> > hand copy some oops text:
> >
> > EIP is at driver_sysfs_remove+0x1a/0x40
> > Call Trace:
> > show_trace_log_lvl+0x1a/0x30
> > show_stack_log_lvl+0x9a/0xc0
> > show_registers+0xc7/0x270
> > die+0x129/0x240
> > do_page_fault+0x3a1/0x670
> > error_code+0x72/0x78
> > __device_release_driver+0x1e/0xa0
> > device_release_driver+0x30/0x50
> > bus_remove_device+0x63/0x90
> > device_del+0x55/0x190
> > del_conn+0xb/0x10 [bluetooth]
> > run_workqueue+0xe1/0x210
> > worker_thread+0x99/0xf0
> > kthread+0x5c/0xa0
> > kernel_thread_helper+0x7/0x18
> >
> > (The remote bluetooth device is a mobile phone which is power off)
> >
> > The reason is that in bus_remobe_dev, the klist_del function will release the device, so just add a get/put pair around the device_del in del_conn.
> >
> > Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
> >
> > ---
> > net/bluetooth/hci_sysfs.c | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff -upr linux/net/bluetooth/hci_sysfs.c linux.new/net/bluetooth/hci_sysfs.c
> > --- linux/net/bluetooth/hci_sysfs.c 2007-12-25 17:45:09.000000000 +0800
> > +++ linux.new/net/bluetooth/hci_sysfs.c 2007-12-25 17:45:51.000000000 +0800
> > @@ -319,7 +319,9 @@ void hci_conn_add_sysfs(struct hci_conn
> > static void del_conn(struct work_struct *work)
> > {
> > struct hci_conn *conn = container_of(work, struct hci_conn, work);
> > + get_device(&conn->dev);
> > device_del(&conn->dev);
> > + put_device(&conn->dev);
> > }
> >
> > void hci_conn_del_sysfs(struct hci_conn *conn)
> >
>
> Hi greg,
>
> BTW, Is it a possible bug of driver core or kobject ?
>

In device_del

if(parent)
klist_del() will drop the kref of device

and then in bus_remove_device
klist_del() will drop it again, so the device would be released.

then the following works will oops.

So might my patch is a wrong fix. how about the below one:

Signed-off-by: Dave Young <hidave.darkstar@gmail.com>

---
drivers/base/core.c | 2 ++
1 file changed, 2 insertions(+)

diff -upr linux/drivers/base/core.c linux.new/drivers/base/core.c
--- linux/drivers/base/core.c 2007-12-26 11:00:49.000000000 +0800
+++ linux.new/drivers/base/core.c 2007-12-26 11:01:18.000000000 +0800
@@ -926,6 +926,7 @@ void device_del(struct device * dev)
struct device * parent = dev->parent;
struct class_interface *class_intf;

+ dev = get_device(dev);
if (parent)
klist_del(&dev->knode_parent);
if (MAJOR(dev->devt))
@@ -966,6 +967,7 @@ void device_del(struct device * dev)
cleanup_device_parent(dev);
kobject_del(&dev->kobj);
put_device(parent);
+ put_device(dev);
}

/**