From: Luca Weiss <luca@z3ntu.xyz>
To: Amit Kucheria <amitk@kernel.org>,
Daniel Lezcano <daniel.lezcano@linaro.org>,
"Rafael J. Wysocki" <rafael@kernel.org>,
Viresh Kumar <viresh.kumar@linaro.org>,
Zhang Rui <rui.zhang@intel.com>,
Caleb Connolly <caleb.connolly@linaro.org>
Cc: Yang Yingliang <yangyingliang@huawei.com>,
Caleb Connolly <caleb.connolly@linaro.org>,
linux-pm@vger.kernel.org,
"Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
Subject: Re: [PATCH v3] thermal/core: fix error paths in __thermal_cooling_device_register()
Date: Thu, 12 Jan 2023 22:43:40 +0100 [thread overview]
Message-ID: <5894723.lOV4Wx5bFT@g550jk> (raw)
In-Reply-To: <20230112154721.452292-1-caleb.connolly@linaro.org>
On Donnerstag, 12. Jänner 2023 16:47:20 CET Caleb Connolly wrote:
> There is in invalid call to thermal_cooling_device_destroy_sysfs() and
> another to put_device() in the error paths here. Fix them.
>
> Fixes: c408b3d1d9bb ("thermal: Validate new state in cur_state_store()")
> Signed-off-by: Caleb Connolly <caleb.connolly@linaro.org>
Fixes attached warnings on boot on qcom-apq8026-lg-lenok (with smbb driver)
Tested-by: Luca Weiss <luca@z3ntu.xyz>
[ 2.095494] qcom-smbb fc4cf000.spmi:pm8226@0:charger@1000: Initializing SMBB rev 1
[ 2.097362] ------------[ cut here ]------------
[ 2.103582] WARNING: CPU: 0 PID: 1 at lib/kobject.c:718 kobject_put+0xcc/0x130
[ 2.108393] kobject: '(null)' ((ptrval)): is not initialized, yet kobject_put() is being called.
[ 2.115406] Modules linked in:
[ 2.124340] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.2.0-rc3-00011-gd6a0fe8a370f #229
[ 2.127151] Hardware name: Generic DT based system
[ 2.135394] unwind_backtrace from show_stack+0x10/0x14
[ 2.139988] show_stack from dump_stack_lvl+0x40/0x4c
[ 2.145111] dump_stack_lvl from __warn+0x78/0x158
[ 2.150317] __warn from warn_slowpath_fmt+0x98/0xc8
[ 2.155006] warn_slowpath_fmt from kobject_put+0xcc/0x130
[ 2.160128] kobject_put from __thermal_cooling_device_register.part.0+0xf8/0x388
[ 2.165432] __thermal_cooling_device_register.part.0 from __power_supply_register+0x43c/0x534
[ 2.172986] __power_supply_register from devm_power_supply_register+0x54/0x90
[ 2.181489] devm_power_supply_register from smbb_charger_probe+0x278/0x614
[ 2.188690] smbb_charger_probe from platform_probe+0x5c/0xb0
[ 2.195546] platform_probe from really_probe+0xc8/0x2ec
[ 2.201447] really_probe from __driver_probe_device+0x84/0xe4
[ 2.206830] __driver_probe_device from driver_probe_device+0x30/0x104
[ 2.212474] driver_probe_device from __driver_attach+0x90/0x174
[ 2.218983] __driver_attach from bus_for_each_dev+0x7c/0xc4
[ 2.225145] bus_for_each_dev from bus_add_driver+0x164/0x1f0
[ 2.230789] bus_add_driver from driver_register+0x88/0x11c
[ 2.236429] driver_register from do_one_initcall+0x5c/0x274
[ 2.241812] do_one_initcall from kernel_init_freeable+0x1a8/0x204
[ 2.247717] kernel_init_freeable from kernel_init+0x18/0x130
[ 2.253704] kernel_init from ret_from_fork+0x14/0x2c
[ 2.259517] Exception stack(0xd0815fb0 to 0xd0815ff8)
[ 2.264555] 5fa0: 00000000 00000000 00000000 00000000
[ 2.269604] 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 2.277762] 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000
[ 2.286024] ---[ end trace 0000000000000000 ]---
[ 2.292369] ------------[ cut here ]------------
[ 2.297253] WARNING: CPU: 0 PID: 1 at lib/refcount.c:28 __thermal_cooling_device_register.part.0+0xf8/0x388
[ 2.301844] refcount_t: underflow; use-after-free.
[ 2.311337] Modules linked in:
[ 2.316178] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W 6.2.0-rc3-00011-gd6a0fe8a370f #229
[ 2.319168] Hardware name: Generic DT based system
[ 2.328789] unwind_backtrace from show_stack+0x10/0x14
[ 2.333478] show_stack from dump_stack_lvl+0x40/0x4c
[ 2.338598] dump_stack_lvl from __warn+0x78/0x158
[ 2.343806] __warn from warn_slowpath_fmt+0x98/0xc8
[ 2.348494] warn_slowpath_fmt from __thermal_cooling_device_register.part.0+0xf8/0x388
[ 2.353626] __thermal_cooling_device_register.part.0 from __power_supply_register+0x43c/0x534
[ 2.361354] __power_supply_register from devm_power_supply_register+0x54/0x90
[ 2.370030] devm_power_supply_register from smbb_charger_probe+0x278/0x614
[ 2.377231] smbb_charger_probe from platform_probe+0x5c/0xb0
[ 2.384086] platform_probe from really_probe+0xc8/0x2ec
[ 2.389987] really_probe from __driver_probe_device+0x84/0xe4
[ 2.395371] __driver_probe_device from driver_probe_device+0x30/0x104
[ 2.401015] driver_probe_device from __driver_attach+0x90/0x174
[ 2.407524] __driver_attach from bus_for_each_dev+0x7c/0xc4
[ 2.413686] bus_for_each_dev from bus_add_driver+0x164/0x1f0
[ 2.419329] bus_add_driver from driver_register+0x88/0x11c
[ 2.424971] driver_register from do_one_initcall+0x5c/0x274
[ 2.430353] do_one_initcall from kernel_init_freeable+0x1a8/0x204
[ 2.436257] kernel_init_freeable from kernel_init+0x18/0x130
[ 2.442245] kernel_init from ret_from_fork+0x14/0x2c
[ 2.448059] Exception stack(0xd0815fb0 to 0xd0815ff8)
[ 2.453097] 5fa0: 00000000 00000000 00000000 00000000
[ 2.458145] 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 2.466303] 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000
[ 2.474560] ---[ end trace 0000000000000000 ]---
[ 2.481478] qcom-smbb fc4cf000.spmi:pm8226@0:charger@1000: failed to register USB power supply
[ 2.485838] qcom-smbb: probe of fc4cf000.spmi:pm8226@0:charger@1000 failed with error -11
Regards
Luca
> ---
> Changes since v2:
> * Rework and simplify into one patch following Yang's suggestions.
>
> V2:
> https://lore.kernel.org/all/20230103171811.204196-1-caleb.connolly@linaro.o
> rg/ ---
> drivers/thermal/thermal_core.c | 11 ++++++-----
> 1 file changed, 6 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
> index f17ab2316dbd..321d2a6300c4 100644
> --- a/drivers/thermal/thermal_core.c
> +++ b/drivers/thermal/thermal_core.c
> @@ -909,15 +909,16 @@ __thermal_cooling_device_register(struct device_node
> *np, cdev->devdata = devdata;
>
> ret = cdev->ops->get_max_state(cdev, &cdev->max_state);
> - if (ret)
> - goto out_kfree_type;
> + if (ret) {
> + kfree(cdev->type);
> + goto out_ida_remove;
> + }
>
> thermal_cooling_device_setup_sysfs(cdev);
> ret = dev_set_name(&cdev->device, "cooling_device%d", cdev->id);
> - if (ret) {
> - thermal_cooling_device_destroy_sysfs(cdev);
> + if (ret)
> goto out_kfree_type;
> - }
> +
> ret = device_register(&cdev->device);
> if (ret)
> goto out_kfree_type;
next prev parent reply other threads:[~2023-01-12 21:51 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-01-12 15:47 [PATCH v3] thermal/core: fix error paths in __thermal_cooling_device_register() Caleb Connolly
2023-01-12 21:43 ` Luca Weiss [this message]
2023-01-16 4:23 ` Viresh Kumar
2023-01-16 12:22 ` Caleb Connolly
2023-01-17 4:40 ` Viresh Kumar
2023-01-16 12:38 ` Yang Yingliang
2023-01-17 4:36 ` Viresh Kumar
2023-01-17 13:39 ` Rafael J. Wysocki
2023-01-17 18:11 ` Caleb Connolly
2023-01-18 4:18 ` Viresh Kumar
2023-01-16 12:52 ` Yang Yingliang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5894723.lOV4Wx5bFT@g550jk \
--to=luca@z3ntu.xyz \
--cc=amitk@kernel.org \
--cc=caleb.connolly@linaro.org \
--cc=daniel.lezcano@linaro.org \
--cc=linux-pm@vger.kernel.org \
--cc=rafael.j.wysocki@intel.com \
--cc=rafael@kernel.org \
--cc=rui.zhang@intel.com \
--cc=viresh.kumar@linaro.org \
--cc=yangyingliang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox