From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org
Cc: mochel@digitalimplant.org
Subject: [PATCH] Driver Core: fix bk-driver-core kills ppc64
Date: Mon, 20 Jun 2005 15:59:27 -0700 [thread overview]
Message-ID: <11193083672817@kroah.com> (raw)
In-Reply-To: <1119308366638@kroah.com>
[PATCH] Driver Core: fix bk-driver-core kills ppc64
There's no check to see if the device is already bound to a driver, which
could do bad things. The first thing to go wrong is that it will try to match
a driver with a device already bound to one. In some cases (it appears with
USB with drivers/usb/core/usb.c::usb_match_id()), some drivers will match a
device based on the class type, so it would be common (especially for HID
devices) to match a device that is already bound.
The fun comes when ->probe() is called, it fails, then
driver_probe_device() does this:
dev->driver = NULL;
Later on, that pointer could be be dereferenced without checking and cause
hell to break loose.
This problem could be nasty. It's very hardware dependent, since some
devices could have a different set of matching qualifiers than others.
Now, I don't quite see exactly where/how you were getting that crash.
You're dereferencing bad memory, but I'm not sure which pointer was bad
and where it came from, but it could have come from a couple of different
places.
The patch below will hopefully fix it all up for you. It's against
2.6.12-rc2-mm1, and does the following:
- Move logic to driver_probe_device() and comments uncommon returns:
1 - If device is bound
0 - If device not bound, and no error
error - If there was an error.
- Move locking to caller of that function, since we want to lock a
device for the entire time we're trying to bind it to a driver (to
prevent against a driver being loaded at the same time).
- Update __device_attach() and __driver_attach() to do that locking.
- Check if device is already bound in __driver_attach()
- Update the converse device_release_driver() so it locks the device
around all of the operations.
- Mark driver_probe_device() as static and remove export. It's an
internal function, it should stay that way, and there are no other
callers. If there is ever a need to export it, we can audit it as
necessary.
Signed-off-by: Andrew Morton <akpm@osdl.org>
---
commit 0d3e5a2e39b6ba2974e9e7c2a429018c45de8e76
tree 30e584b73c356adce49dcc9df75332abaef95470
parent b86c1df1f98d16c999423a3907eb40a9423f481e
author Patrick Mochel <mochel@digitalimplant.org> Tue, 05 Apr 2005 23:46:33 -0700
committer Greg Kroah-Hartman <gregkh@suse.de> Mon, 20 Jun 2005 15:15:27 -0700
drivers/base/dd.c | 140 +++++++++++++++++++++++++-----------------------
include/linux/device.h | 1
2 files changed, 73 insertions(+), 68 deletions(-)
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -35,6 +35,8 @@
* nor take the bus's rwsem. Please verify those are accounted
* for before calling this. (It is ok to call with no other effort
* from a driver's probe() method.)
+ *
+ * This function must be called with @dev->sem held.
*/
void device_bind_driver(struct device * dev)
{
@@ -57,54 +59,56 @@ void device_bind_driver(struct device *
* because we don't know the format of the ID structures, nor what
* is to be considered a match and what is not.
*
- * If we find a match, we call @drv->probe(@dev) if it exists, and
- * call device_bind_driver() above.
+ *
+ * This function returns 1 if a match is found, an error if one
+ * occurs (that is not -ENODEV or -ENXIO), and 0 otherwise.
+ *
+ * This function must be called with @dev->sem held.
*/
-int driver_probe_device(struct device_driver * drv, struct device * dev)
+static int driver_probe_device(struct device_driver * drv, struct device * dev)
{
- int error = 0;
+ int ret = 0;
if (drv->bus->match && !drv->bus->match(dev, drv))
- return -ENODEV;
+ goto Done;
- down(&dev->sem);
+ pr_debug("%s: Matched Device %s with Driver %s\n",
+ drv->bus->name, dev->bus_id, drv->name);
dev->driver = drv;
if (drv->probe) {
- error = drv->probe(dev);
- if (error) {
+ ret = drv->probe(dev);
+ if (ret) {
dev->driver = NULL;
- up(&dev->sem);
- return error;
+ goto ProbeFailed;
}
}
- up(&dev->sem);
device_bind_driver(dev);
- return 0;
+ ret = 1;
+ pr_debug("%s: Bound Device %s to Driver %s\n",
+ drv->bus->name, dev->bus_id, drv->name);
+ goto Done;
+
+ ProbeFailed:
+ if (ret == -ENODEV || ret == -ENXIO) {
+ /* Driver matched, but didn't support device
+ * or device not found.
+ * Not an error; keep going.
+ */
+ ret = 0;
+ } else {
+ /* driver matched but the probe failed */
+ printk(KERN_WARNING
+ "%s: probe of %s failed with error %d\n",
+ drv->name, dev->bus_id, ret);
+ }
+ Done:
+ return ret;
}
static int __device_attach(struct device_driver * drv, void * data)
{
struct device * dev = data;
- int error;
-
- error = driver_probe_device(drv, dev);
- if (error) {
- if ((error == -ENODEV) || (error == -ENXIO)) {
- /* Driver matched, but didn't support device
- * or device not found.
- * Not an error; keep going.
- */
- error = 0;
- } else {
- /* driver matched but the probe failed */
- printk(KERN_WARNING
- "%s: probe of %s failed with error %d\n",
- drv->name, dev->bus_id, error);
- }
- return error;
- }
- /* stop looking, this device is attached */
- return 1;
+ return driver_probe_device(drv, dev);
}
/**
@@ -114,37 +118,43 @@ static int __device_attach(struct device
* Walk the list of drivers that the bus has and call
* driver_probe_device() for each pair. If a compatible
* pair is found, break out and return.
+ *
+ * Returns 1 if the device was bound to a driver; 0 otherwise.
*/
int device_attach(struct device * dev)
{
+ int ret = 0;
+
+ down(&dev->sem);
if (dev->driver) {
device_bind_driver(dev);
- return 1;
- }
-
- return bus_for_each_drv(dev->bus, NULL, dev, __device_attach);
+ ret = 1;
+ } else
+ ret = bus_for_each_drv(dev->bus, NULL, dev, __device_attach);
+ up(&dev->sem);
+ return ret;
}
static int __driver_attach(struct device * dev, void * data)
{
struct device_driver * drv = data;
- int error = 0;
- if (!dev->driver) {
- error = driver_probe_device(drv, dev);
- if (error) {
- if (error != -ENODEV) {
- /* driver matched but the probe failed */
- printk(KERN_WARNING
- "%s: probe of %s failed with error %d\n",
- drv->name, dev->bus_id, error);
- } else
- error = 0;
- return error;
- }
- /* stop looking, this driver is attached */
- return 1;
- }
+ /*
+ * Lock device and try to bind to it. We drop the error
+ * here and always return 0, because we need to keep trying
+ * to bind to devices and some drivers will return an error
+ * simply if it didn't support the device.
+ *
+ * driver_probe_device() will spit a warning if there
+ * is an error.
+ */
+
+ down(&dev->sem);
+ if (!dev->driver)
+ driver_probe_device(drv, dev);
+ up(&dev->sem);
+
+
return 0;
}
@@ -156,9 +166,6 @@ static int __driver_attach(struct device
* match the driver with each one. If driver_probe_device()
* returns 0 and the @dev->driver is set, we've found a
* compatible pair.
- *
- * Note that we ignore the -ENODEV error from driver_probe_device(),
- * since it's perfectly valid for a driver not to bind to any devices.
*/
void driver_attach(struct device_driver * drv)
{
@@ -176,19 +183,19 @@ void driver_attach(struct device_driver
*/
void device_release_driver(struct device * dev)
{
- struct device_driver * drv = dev->driver;
-
- if (!drv)
- return;
-
- sysfs_remove_link(&drv->kobj, kobject_name(&dev->kobj));
- sysfs_remove_link(&dev->kobj, "driver");
- klist_del(&dev->knode_driver);
+ struct device_driver * drv;
down(&dev->sem);
- if (drv->remove)
- drv->remove(dev);
- dev->driver = NULL;
+ if (dev->driver) {
+ drv = dev->driver;
+ sysfs_remove_link(&drv->kobj, kobject_name(&dev->kobj));
+ sysfs_remove_link(&dev->kobj, "driver");
+ klist_del(&dev->knode_driver);
+
+ if (drv->remove)
+ drv->remove(dev);
+ dev->driver = NULL;
+ }
up(&dev->sem);
}
@@ -208,7 +215,6 @@ void driver_detach(struct device_driver
}
-EXPORT_SYMBOL_GPL(driver_probe_device);
EXPORT_SYMBOL_GPL(device_bind_driver);
EXPORT_SYMBOL_GPL(device_release_driver);
EXPORT_SYMBOL_GPL(device_attach);
diff --git a/include/linux/device.h b/include/linux/device.h
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -325,7 +325,6 @@ extern int device_for_each_child(struct
* Manual binding of a device to driver. See drivers/base/bus.c
* for information on use.
*/
-extern int driver_probe_device(struct device_driver * drv, struct device * dev);
extern void device_bind_driver(struct device * dev);
extern void device_release_driver(struct device * dev);
extern int device_attach(struct device * dev);
next prev parent reply other threads:[~2005-06-21 2:45 UTC|newest]
Thread overview: 92+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-06-20 22:55 [GIT PATCH] Driver core changes for 2.6.12 Greg KH
2005-06-20 22:59 ` [PATCH] sysfs_{create|remove}_link should take const char * Greg KH
2005-06-20 22:59 ` [PATCH] kobject_hotplug() should use kobject_name() Greg KH
2005-06-20 22:59 ` [PATCH] Make kobject's name be const char * Greg KH
2005-06-20 22:59 ` [PATCH] kset_hotplug_ops->name shoudl return " Greg KH
2005-06-20 22:59 ` [PATCH] make driver's name be " Greg KH
2005-06-20 22:59 ` [PATCH] Make attributes names " Greg KH
2005-06-20 22:59 ` [PATCH] sysfs: (driver/base) if show/store is missing return -EIO Greg KH
2005-06-20 22:59 ` [PATCH] sysfs: " Greg KH
2005-06-20 22:59 ` [PATCH] sysfs: (driver/pci) " Greg KH
2005-06-20 22:59 ` [PATCH] sysfs: (driver/block) " Greg KH
2005-06-20 22:59 ` [PATCH] sysfs: (rest) " Greg KH
2005-06-20 22:59 ` [PATCH] INPUT: move to use the new class code, instead of class_simple Greg KH
2005-06-20 22:59 ` [PATCH] tty: " Greg KH
2005-06-20 22:59 ` [PATCH] CLASS: move a "simple" class logic into the class core Greg KH
2005-06-20 22:59 ` [PATCH] class: convert sound/* to use the new class api instead of class_simple Greg KH
2005-06-20 22:59 ` [PATCH] USB: move the usb hcd code to use the new class code Greg KH
2005-06-20 22:59 ` [PATCH] class: convert drivers/block/* to use the new class api instead of class_simple Greg KH
2005-06-20 22:59 ` [PATCH] class: convert drivers/ieee1394/* " Greg KH
2005-06-20 22:59 ` [PATCH] class: convert drivers/char/* " Greg KH
2005-06-20 22:59 ` [PATCH] class: convert drivers/scsi/* " Greg KH
2005-06-20 22:59 ` [PATCH] class: convert drivers/* " Greg KH
2005-06-20 22:59 ` [PATCH] USB: trivial error path fix Greg KH
2005-06-20 22:59 ` [PATCH] class: convert arch/* to use the new class api instead of class_simple Greg KH
2005-06-20 22:59 ` [PATCH] class: convert the remaining class_simple users in the kernel to usee the new class api Greg KH
2005-06-20 22:59 ` [PATCH] class: add kerneldoc for the new class functions Greg KH
2005-06-20 22:59 ` [PATCH] class: remove class_simple code, as no one in the tree is using it anymore Greg KH
2005-06-20 22:59 ` [PATCH] fix "make mandocs" after class_simple.c removal Greg KH
2005-06-20 22:59 ` [PATCH] Add a semaphore to struct device to synchronize calls to its driver Greg KH
2005-06-20 22:59 ` [PATCH] fix up ipmi code after class_simple.c removal Greg KH
2005-06-20 22:59 ` [PATCH] Move device/driver code to drivers/base/dd.c Greg KH
2005-06-20 22:59 ` [PATCH] Use driver_for_each_device() instead of manually walking list Greg KH
2005-06-20 22:59 ` [PATCH] Use driver_for_each_device() in drivers/pnp/driver.c " Greg KH
2005-06-20 22:59 ` [PATCH] Add driver_for_each_device() Greg KH
2005-06-20 22:59 ` [PATCH] Add a klist to struct bus_type for its drivers Greg KH
2005-06-20 22:59 ` [PATCH] Add a klist to struct bus_type for its devices Greg KH
2005-06-20 22:59 ` [PATCH] Add initial implementation of klist helpers Greg KH
2005-06-20 22:59 ` [PATCH] Add a klist to struct device_driver for the devices bound to it Greg KH
2005-06-20 22:59 ` [PATCH] Remove the unused device_find() Greg KH
2005-06-20 22:59 ` [PATCH] Use bus_for_each_{dev,drv} for driver binding Greg KH
2005-06-20 22:59 ` [PATCH] add klist_node_attached() to determine if a node is on a list or not Greg KH
2005-06-20 22:59 ` [PATCH] Fix up USB to use klist_node_attached() instead of list_empty() on lists that will go away Greg KH
2005-06-20 22:59 ` [PATCH] Remove struct device::driver_list Greg KH
2005-06-20 22:59 ` [PATCH] Fix up bus code and remove use of rwsem Greg KH
2005-06-20 22:59 ` [PATCH] Remove struct device::bus_list Greg KH
2005-06-20 22:59 ` [PATCH] Don't reference NULL klist pointer in klist_remove() Greg KH
2005-06-20 22:59 ` [PATCH] Call klist_del() instead of klist_remove() Greg KH
2005-06-20 22:59 ` [PATCH] Use device_for_each_child() to unregister devices in scsi_remove_target() Greg KH
2005-06-20 22:59 ` [PATCH] use device_for_each_child() to properly access child devices Greg KH
2005-06-20 22:59 ` [PATCH] Use a klist for device child lists Greg KH
2005-06-20 22:59 ` [PATCH] Fix up bogus comment Greg KH
2005-06-20 22:59 ` [PATCH] driver core: change export symbol for driver_for_each_device() Greg KH
2005-06-20 22:59 ` [PATCH] Use device_for_each_child() to unregister devices in nodemgr_remove_host_dev() Greg KH
2005-06-20 22:59 ` [PATCH] use device_for_each_child() to properly access child devices Greg KH
2005-06-20 22:59 ` [PATCH] USB: fix build warning in usb core as pointed out by Andrew Greg KH
2005-06-20 22:59 ` Greg KH [this message]
2005-06-20 22:59 ` [PATCH] Fix typo in scdrv_init() Greg KH
2005-06-20 22:59 ` [PATCH] Driver core: Fix up the driver and device iterators to be quieter Greg KH
2005-06-20 22:59 ` [PATCH] usb: klist_node_attached() fix Greg KH
2005-06-20 22:59 ` [PATCH] sn: fixes due to driver core changes Greg KH
2005-06-20 22:59 ` [PATCH] driver core: Fix races in driver_detach() Greg KH
2005-06-20 22:59 ` [PATCH] Driver Core: driver model doc update Greg KH
2005-06-20 22:59 ` [PATCH] Driver core: unregister_node() for hotplug use Greg KH
2005-06-20 22:59 ` [PATCH] usbcore: Don't call device_release_driver recursively Greg KH
2005-06-20 22:59 ` [PATCH] libfs: add simple attribute files Greg KH
2005-06-20 22:59 ` [PATCH] Driver core: change device_attribute callbacks Greg KH
2005-06-20 22:59 ` [PATCH] driver core: fix error handling in bus_add_device Greg KH
2005-06-20 22:59 ` [PATCH] Driver core: Documentation: update device attribute callbacks Greg KH
2005-06-20 22:59 ` [PATCH] Driver Core: drivers/base - drivers/i2c/chips/adm1026.c: " Greg KH
2005-06-20 22:59 ` [PATCH] Driver Core: arch: " Greg KH
2005-06-20 22:59 ` [PATCH] Driver Core: drivers/i2c/chips/adm1031.c - lm75.c: " Greg KH
2005-06-20 22:59 ` [PATCH] Driver Core: drivers/i2c/chips/lm77.c - max1619.c: " Greg KH
2005-06-20 22:59 ` [PATCH] Driver Core: drivers/i2c/chips/pc87360.c - w83627hf.c: " Greg KH
2005-06-20 22:59 ` [PATCH] Driver Core: drivers/char/raw3270.c - drivers/net/netiucv.c: " Greg KH
2005-06-20 22:59 ` [PATCH] Driver Core: drivers/i2c/chips/w83781d.c - drivers/s390/block/dcssblk.c: " Greg KH
2005-06-20 22:59 ` [PATCH] Driver Core: drivers/usb/input/aiptek.c - drivers/zorro/zorro-sysfs.c: " Greg KH
2005-06-20 22:59 ` [PATCH] Driver Core: drivers/s390/net/qeth_sys.c - drivers/usb/gadget/pxa2xx_udc.c: " Greg KH
2005-06-20 22:59 ` [PATCH] Driver Core: include: " Greg KH
2005-06-20 22:59 ` [PATCH] I2C: drivers/i2c/chips/adm1026.c: use dynamic sysfs callbacks Greg KH
2005-06-20 22:59 ` [PATCH] I2C: add i2c sensor_device_attribute and macros Greg KH
2005-06-20 22:59 ` [PATCH] sysfs-iattr: attach sysfs_dirent before new inode Greg KH
2005-06-20 22:59 ` [PATCH] Driver core: Don't "lose" devices on suspend on failure Greg KH
2005-06-20 22:59 ` [PATCH] sysfs-iattr: set inode attributes Greg KH
2005-06-20 22:59 ` [PATCH] sysfs-iattr: add sysfs_setattr Greg KH
2005-06-20 22:59 ` [PATCH] SYSFS: fix PAGE_SIZE check Greg KH
2005-06-20 22:59 ` [PATCH] USB: fix show_modalias() function due to attribute change Greg KH
2005-06-20 22:59 ` [PATCH] PCI: " Greg KH
2005-07-06 0:38 ` [PATCH] Use device_for_each_child() to unregister devices in scsi_remove_target() Patrick Mansfield
2005-07-12 0:20 ` Greg KH
2005-07-12 0:56 ` Patrick Mansfield
2005-06-21 11:42 ` [PATCH] Add initial implementation of klist helpers Rik van Riel
2005-06-21 23:13 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=11193083672817@kroah.com \
--to=gregkh@suse.de \
--cc=greg@kroah.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mochel@digitalimplant.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox