From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ale.deltatee.com ([207.54.116.67]:56499 "EHLO ale.deltatee.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751156AbdCQSuZ (ORCPT ); Fri, 17 Mar 2017 14:50:25 -0400 From: Logan Gunthorpe To: Greg Kroah-Hartman , Dan Williams , Hans Verkuil , Alexander Viro , Alexandre Belloni , Jason Gunthorpe , Johannes Thumshirn , Dmitry Torokhov , Linus Walleij , Jarkko Sakkinen , "James E.J. Bottomley" , "Martin K. Petersen" , David Woodhouse , Brian Norris , Boris Brezillon , Marek Vasut , Cyrille Pitchen Cc: linux-pci@vger.kernel.org, linux-scsi@vger.kernel.org, rtc-linux@googlegroups.com, linux-mtd@lists.infradead.org, linux-media@vger.kernel.org, linux-iio@vger.kernel.org, linux-rdma@vger.kernel.org, linux-gpio@vger.kernel.org, linux-input@vger.kernel.org, linux-nvdimm@lists.01.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, Logan Gunthorpe Date: Fri, 17 Mar 2017 12:48:20 -0600 Message-Id: <1489776503-3151-14-git-send-email-logang@deltatee.com> In-Reply-To: <1489776503-3151-1-git-send-email-logang@deltatee.com> References: <1489776503-3151-1-git-send-email-logang@deltatee.com> Subject: [PATCH v5 13/16] rapidio: utilize new cdev_device_add helper function Sender: linux-fsdevel-owner@vger.kernel.org List-ID: This driver did not originally set kobj.parent so it likely had potential a use after free bug which this patch fixes. We convert from device_register to device_initialize/cdev_device_add. While we are at it we use put_device instead of kfree (as recommended by the device_initialize documentation). We also remove an unnecessary extra get_device from the code. Signed-off-by: Logan Gunthorpe --- drivers/rapidio/devices/rio_mport_cdev.c | 24 ++++++++---------------- 1 file changed, 8 insertions(+), 16 deletions(-) diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c index 50b617a..5beb0c3 100644 --- a/drivers/rapidio/devices/rio_mport_cdev.c +++ b/drivers/rapidio/devices/rio_mport_cdev.c @@ -2444,31 +2444,25 @@ static struct mport_dev *mport_cdev_add(struct rio_mport *mport) mutex_init(&md->buf_mutex); mutex_init(&md->file_mutex); INIT_LIST_HEAD(&md->file_list); - cdev_init(&md->cdev, &mport_fops); - md->cdev.owner = THIS_MODULE; - ret = cdev_add(&md->cdev, MKDEV(MAJOR(dev_number), mport->id), 1); - if (ret < 0) { - kfree(md); - rmcd_error("Unable to register a device, err=%d", ret); - return NULL; - } - md->dev.devt = md->cdev.dev; + device_initialize(&md->dev); + md->dev.devt = MKDEV(MAJOR(dev_number), mport->id); md->dev.class = dev_class; md->dev.parent = &mport->dev; md->dev.release = mport_device_release; dev_set_name(&md->dev, DEV_NAME "%d", mport->id); atomic_set(&md->active, 1); - ret = device_register(&md->dev); + cdev_init(&md->cdev, &mport_fops); + md->cdev.owner = THIS_MODULE; + + ret = cdev_device_add(&md->cdev, &md->dev); if (ret) { rmcd_error("Failed to register mport %d (err=%d)", mport->id, ret); goto err_cdev; } - get_device(&md->dev); - INIT_LIST_HEAD(&md->doorbells); spin_lock_init(&md->db_lock); INIT_LIST_HEAD(&md->portwrites); @@ -2513,8 +2507,7 @@ static struct mport_dev *mport_cdev_add(struct rio_mport *mport) return md; err_cdev: - cdev_del(&md->cdev); - kfree(md); + put_device(&md->dev); return NULL; } @@ -2578,7 +2571,7 @@ static void mport_cdev_remove(struct mport_dev *md) atomic_set(&md->active, 0); mport_cdev_terminate_dma(md); rio_del_mport_pw_handler(md->mport, md, rio_mport_pw_handler); - cdev_del(&(md->cdev)); + cdev_device_del(&md->cdev, &md->dev); mport_cdev_kill_fasync(md); flush_workqueue(dma_wq); @@ -2603,7 +2596,6 @@ static void mport_cdev_remove(struct mport_dev *md) rio_release_inb_dbell(md->mport, 0, 0x0fff); - device_unregister(&md->dev); put_device(&md->dev); } -- 2.1.4