* [PATCH] iio: hid-sensors: Prevent crash during hot-unplug
@ 2012-09-20 0:15 Srinivas Pandruvada
2012-09-22 9:08 ` Jonathan Cameron
0 siblings, 1 reply; 2+ messages in thread
From: Srinivas Pandruvada @ 2012-09-20 0:15 UTC (permalink / raw)
To: jic23; +Cc: linux-iio, Srinivas Pandruvada
When hid sensor hub is unplugged, there is a crash in
iio_device_unregister_trigger_consumer.
In a typical IIO driver when remove is called, it will unregister and free
trigger and then it will call iio_device_free.
The function iio_trigger_free() will free the allocated memory for trigger.
If this trigger was assigned to iio_dev->trig, then it should be set to NULL.
Othewise when iio_device_free() is called later, it finally calls
iio_device_unregsister_trigger(), which checks for
if (indio_dev->trig)
iio_trigger_put(indio_dev->trig);
If indio_dev->trig is not set to NULL, it calls iio_trigger_put on a bad
pointer causing crash.
This scenerio can happen in any driver, which is storing trigger pointer in
iio_dev structure and following current procedure during remove.
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
---
drivers/iio/common/hid-sensors/hid-sensor-trigger.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
index 12277e8..d4b790d 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
@@ -56,6 +56,7 @@ void hid_sensor_remove_trigger(struct iio_dev *indio_dev)
{
iio_trigger_unregister(indio_dev->trig);
iio_trigger_free(indio_dev->trig);
+ indio_dev->trig = NULL;
}
EXPORT_SYMBOL(hid_sensor_remove_trigger);
--
1.7.11.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] iio: hid-sensors: Prevent crash during hot-unplug
2012-09-20 0:15 [PATCH] iio: hid-sensors: Prevent crash during hot-unplug Srinivas Pandruvada
@ 2012-09-22 9:08 ` Jonathan Cameron
0 siblings, 0 replies; 2+ messages in thread
From: Jonathan Cameron @ 2012-09-22 9:08 UTC (permalink / raw)
To: Srinivas Pandruvada; +Cc: linux-iio
On 09/20/2012 01:15 AM, Srinivas Pandruvada wrote:
> When hid sensor hub is unplugged, there is a crash in
> iio_device_unregister_trigger_consumer.
> In a typical IIO driver when remove is called, it will unregister and free
> trigger and then it will call iio_device_free.
> The function iio_trigger_free() will free the allocated memory for trigger.
> If this trigger was assigned to iio_dev->trig, then it should be set to NULL.
> Othewise when iio_device_free() is called later, it finally calls
> iio_device_unregsister_trigger(), which checks for
> if (indio_dev->trig)
> iio_trigger_put(indio_dev->trig);
> If indio_dev->trig is not set to NULL, it calls iio_trigger_put on a bad
> pointer causing crash.
> This scenerio can happen in any driver, which is storing trigger pointer in
> iio_dev structure and following current procedure during remove.
Added to togreg branch.
Good catch, we'll have to audit other drivers for the same problem.
>
> Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
> ---
> drivers/iio/common/hid-sensors/hid-sensor-trigger.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
> index 12277e8..d4b790d 100644
> --- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
> +++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
> @@ -56,6 +56,7 @@ void hid_sensor_remove_trigger(struct iio_dev *indio_dev)
> {
> iio_trigger_unregister(indio_dev->trig);
> iio_trigger_free(indio_dev->trig);
> + indio_dev->trig = NULL;
> }
> EXPORT_SYMBOL(hid_sensor_remove_trigger);
>
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2012-09-22 9:08 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-09-20 0:15 [PATCH] iio: hid-sensors: Prevent crash during hot-unplug Srinivas Pandruvada
2012-09-22 9:08 ` Jonathan Cameron
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).