[patch] drivers: Fix bogus 0 error return in device_add()

[patch] drivers: Fix bogus 0 error return in device_add()

[Thomas Gleixner]

[-- Attachment #1: drivers-base-fix-error-path.patch --]
[-- Type: text/plain, Size: 1168 bytes --]

If device_add() is called with a device which does not have dev->p set
up, then device_private_init() is called. If that succeeds, then the
error variable is set to 0. Now if the dev_name(dev) check further
down fails, then device_add() correctly terminates, but returns 0.
That of course lets the driver progress. If later another driver uses
this half set up device as parent then device_add() of the child
device explodes and renders sysfs completely unusable.

Set the error to -EINVAL if dev_name() check fails.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Greg Kroah-Hartman <gregkh@suse.de>
Cc: Kay Sievers <kay.sievers@vrfy.org>
---
 drivers/base/core.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Index: linux-2.6-tip/drivers/base/core.c
===================================================================
--- linux-2.6-tip.orig/drivers/base/core.c
+++ linux-2.6-tip/drivers/base/core.c
@@ -898,8 +898,10 @@ int device_add(struct device *dev)
 		dev->init_name = NULL;
 	}
 
-	if (!dev_name(dev))
+	if (!dev_name(dev)) {
+		error = -EINVAL;
 		goto name_error;
+	}
 
 	pr_debug("device: '%s': %s\n", dev_name(dev), __func__);
 

Re: [patch] drivers: Fix bogus 0 error return in device_add()

[Greg KH]

On Thu, Dec 10, 2009 at 07:32:49PM -0000, Thomas Gleixner wrote:
> If device_add() is called with a device which does not have dev->p set
> up, then device_private_init() is called. If that succeeds, then the
> error variable is set to 0. Now if the dev_name(dev) check further
> down fails, then device_add() correctly terminates, but returns 0.
> That of course lets the driver progress. If later another driver uses
> this half set up device as parent then device_add() of the child
> device explodes and renders sysfs completely unusable.
> 
> Set the error to -EINVAL if dev_name() check fails.

That's a good catch, thanks.

Is anything currently triggering this?  Or did you just find it by
reading the code?

thanks,

greg k-h

Re: [patch] drivers: Fix bogus 0 error return in device_add()

[Thomas Gleixner]

On Thu, 10 Dec 2009, Greg KH wrote:
> On Thu, Dec 10, 2009 at 07:32:49PM -0000, Thomas Gleixner wrote:
> > If device_add() is called with a device which does not have dev->p set
> > up, then device_private_init() is called. If that succeeds, then the
> > error variable is set to 0. Now if the dev_name(dev) check further
> > down fails, then device_add() correctly terminates, but returns 0.
> > That of course lets the driver progress. If later another driver uses
> > this half set up device as parent then device_add() of the child
> > device explodes and renders sysfs completely unusable.
> > 
> > Set the error to -EINVAL if dev_name() check fails.
> 
> That's a good catch, thanks.
> 
> Is anything currently triggering this?  Or did you just find it by
> reading the code?

Hans-Juergen had a buggy vendor driver where init_name was not
initialized. So the driver probing succeeded and after that a
depending driver crashed somewhere in device_add().

Thanks,

	tglx

Re: [patch] drivers: Fix bogus 0 error return in device_add()

[Greg KH]

On Thu, Dec 10, 2009 at 10:01:10PM +0100, Thomas Gleixner wrote:
> On Thu, 10 Dec 2009, Greg KH wrote:
> > On Thu, Dec 10, 2009 at 07:32:49PM -0000, Thomas Gleixner wrote:
> > > If device_add() is called with a device which does not have dev->p set
> > > up, then device_private_init() is called. If that succeeds, then the
> > > error variable is set to 0. Now if the dev_name(dev) check further
> > > down fails, then device_add() correctly terminates, but returns 0.
> > > That of course lets the driver progress. If later another driver uses
> > > this half set up device as parent then device_add() of the child
> > > device explodes and renders sysfs completely unusable.
> > > 
> > > Set the error to -EINVAL if dev_name() check fails.
> > 
> > That's a good catch, thanks.
> > 
> > Is anything currently triggering this?  Or did you just find it by
> > reading the code?
> 
> Hans-Juergen had a buggy vendor driver where init_name was not
> initialized. So the driver probing succeeded and after that a
> depending driver crashed somewhere in device_add().

Ick, bad code :(

Good to know it's not a problem with in-tree drivers, so I don't have to
add this to the -stable trees.

thanks,

greg k-h

Re: [patch] drivers: Fix bogus 0 error return in device_add()

[Hans J. Koch]

On Thu, Dec 10, 2009 at 10:01:10PM +0100, Thomas Gleixner wrote:
> On Thu, 10 Dec 2009, Greg KH wrote:
> > On Thu, Dec 10, 2009 at 07:32:49PM -0000, Thomas Gleixner wrote:
> > > If device_add() is called with a device which does not have dev->p set
> > > up, then device_private_init() is called. If that succeeds, then the
> > > error variable is set to 0. Now if the dev_name(dev) check further
> > > down fails, then device_add() correctly terminates, but returns 0.
> > > That of course lets the driver progress. If later another driver uses
> > > this half set up device as parent then device_add() of the child
> > > device explodes and renders sysfs completely unusable.
> > > 
> > > Set the error to -EINVAL if dev_name() check fails.
> > 
> > That's a good catch, thanks.
> > 
> > Is anything currently triggering this?  Or did you just find it by
> > reading the code?
> 
> Hans-Juergen had a buggy vendor driver where init_name was not
> initialized. So the driver probing succeeded and after that a
> depending driver crashed somewhere in device_add().

That was one of these USB UDC drivers. It falsely reported OK at probe time
and crashed when modprobing a gadget driver. Complete hang of the machine
could be achieved by just doing "ls /sys"...
Of course, it's the driver's fault not to set init_name, but it's a bit
annoying if such mistakes freeze your machine instead of simply producing
an error that helps fixing the driver.

Thanks,
Hans