[PATCH] drivers/power/88pm860x_battery.c: use devm_request_threaded_irq

[PATCH] drivers/power/88pm860x_battery.c: use devm_request_threaded_irq

[Julia Lawall]

From: Julia Lawall <Julia.Lawall@lip6.fr>

devm_request_threaded_irq requests and irq that is freed when a driver
detaches.  This patch uses devm_request_threaded_irq for irqs that are
requested in the probe function of a platform device and are only freed in
the remove function.

Additionally, the original code used devm_kzalloc, but kfree.  This would
lead to a double free.  The problem was found using the following semantic
match (http://coccinelle.lip6.fr/):

// <smpl>
@@
expression x,e;
@@
x = devm_kzalloc(...)
... when != x = e
?-kfree(x,...);
// </smpl>

The error handling code in the probe function is also simplified in the
cases where there is now nothing to do other than return.

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>

---
 drivers/power/88pm860x_battery.c |   24 ++++++++----------------
 1 file changed, 8 insertions(+), 16 deletions(-)

diff --git a/drivers/power/88pm860x_battery.c b/drivers/power/88pm860x_battery.c
index 8bc80b0..b808177 100644
--- a/drivers/power/88pm860x_battery.c
+++ b/drivers/power/88pm860x_battery.c
@@ -915,15 +915,13 @@ static int pm860x_battery_probe(struct platform_device *pdev)
 	info->irq_cc = platform_get_irq(pdev, 0);
 	if (info->irq_cc <= 0) {
 		dev_err(&pdev->dev, "No IRQ resource!\n");
-		ret = -EINVAL;
-		goto out;
+		return -EINVAL;
 	}
 
 	info->irq_batt = platform_get_irq(pdev, 1);
 	if (info->irq_batt <= 0) {
 		dev_err(&pdev->dev, "No IRQ resource!\n");
-		ret = -EINVAL;
-		goto out;
+		return -EINVAL;
 	}
 
 	info->chip = chip;
@@ -957,10 +955,10 @@ static int pm860x_battery_probe(struct platform_device *pdev)
 
 	ret = power_supply_register(&pdev->dev, &info->battery);
 	if (ret)
-		goto out;
+		return ret;
 	info->battery.dev->parent = &pdev->dev;
 
-	ret = request_threaded_irq(info->irq_cc, NULL,
+	ret = devm_request_threaded_irq(&pdev->dev, info->irq_cc, NULL,
 				pm860x_coulomb_handler, IRQF_ONESHOT,
 				"coulomb", info);
 	if (ret < 0) {
@@ -969,23 +967,20 @@ static int pm860x_battery_probe(struct platform_device *pdev)
 		goto out_reg;
 	}
 
-	ret = request_threaded_irq(info->irq_batt, NULL, pm860x_batt_handler,
-				IRQF_ONESHOT, "battery", info);
+	ret = devm_request_threaded_irq(&pdev->dev, info->irq_batt, NULL,
+					pm860x_batt_handler,
+					IRQF_ONESHOT, "battery", info);
 	if (ret < 0) {
 		dev_err(chip->dev, "Failed to request IRQ: #%d: %d\n",
 			info->irq_batt, ret);
-		goto out_coulomb;
+		goto out_reg;
 	}
 
 
 	return 0;
 
-out_coulomb:
-	free_irq(info->irq_cc, info);
 out_reg:
 	power_supply_unregister(&info->battery);
-out:
-	kfree(info);
 	return ret;
 }
 
@@ -994,9 +989,6 @@ static int pm860x_battery_remove(struct platform_device *pdev)
 	struct pm860x_battery_info *info = platform_get_drvdata(pdev);
 
 	power_supply_unregister(&info->battery);
-	free_irq(info->irq_batt, info);
-	free_irq(info->irq_cc, info);
-	kfree(info);
 	platform_set_drvdata(pdev, NULL);
 	return 0;
 }

Re: [PATCH] drivers/power/88pm860x_battery.c: use devm_request_threaded_irq

[Anton Vorontsov]

On Sat, Dec 08, 2012 at 06:16:35PM +0100, Julia Lawall wrote:
> From: Julia Lawall <Julia.Lawall@lip6.fr>
> 
> devm_request_threaded_irq requests and irq that is freed when a driver
> detaches.  This patch uses devm_request_threaded_irq for irqs that are
> requested in the probe function of a platform device and are only freed in
> the remove function.
> 
> Additionally, the original code used devm_kzalloc, but kfree.  This would
> lead to a double free.  The problem was found using the following semantic
> match (http://coccinelle.lip6.fr/):
> 
> // <smpl>
> @@
> expression x,e;
> @@
> x = devm_kzalloc(...)
> ... when != x = e
> ?-kfree(x,...);
> // </smpl>
> 
> The error handling code in the probe function is also simplified in the
> cases where there is now nothing to do other than return.
> 
> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
> 
> ---
[....]
> @@ -994,9 +989,6 @@ static int pm860x_battery_remove(struct platform_device *pdev)
>  	struct pm860x_battery_info *info = platform_get_drvdata(pdev);
>  
>  	power_supply_unregister(&info->battery);
> -	free_irq(info->irq_batt, info);
> -	free_irq(info->irq_cc, info);
> -	kfree(info);

It is not safe to access battery ('struct power_supply') object after
_unregister() (and irq handlers will surely do). Instead of removing
free_irq(), the right fix would be to place the two calls before
_unregister().

Thanks,
Anton

>  	platform_set_drvdata(pdev, NULL);
>  	return 0;
>  }
> 
> 

Re: [PATCH] drivers/power/88pm860x_battery.c: use devm_request_threaded_irq

[Julia Lawall]

On Sat, 5 Jan 2013, Anton Vorontsov wrote:

> On Sat, Dec 08, 2012 at 06:16:35PM +0100, Julia Lawall wrote:
>> From: Julia Lawall <Julia.Lawall@lip6.fr>
>>
>> devm_request_threaded_irq requests and irq that is freed when a driver
>> detaches.  This patch uses devm_request_threaded_irq for irqs that are
>> requested in the probe function of a platform device and are only freed in
>> the remove function.
>>
>> Additionally, the original code used devm_kzalloc, but kfree.  This would
>> lead to a double free.  The problem was found using the following semantic
>> match (http://coccinelle.lip6.fr/):
>>
>> // <smpl>
>> @@
>> expression x,e;
>> @@
>> x = devm_kzalloc(...)
>> ... when != x = e
>> ?-kfree(x,...);
>> // </smpl>
>>
>> The error handling code in the probe function is also simplified in the
>> cases where there is now nothing to do other than return.
>>
>> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
>>
>> ---
> [....]
>> @@ -994,9 +989,6 @@ static int pm860x_battery_remove(struct platform_device *pdev)
>>  	struct pm860x_battery_info *info = platform_get_drvdata(pdev);
>>
>>  	power_supply_unregister(&info->battery);
>> -	free_irq(info->irq_batt, info);
>> -	free_irq(info->irq_cc, info);
>> -	kfree(info);
>
> It is not safe to access battery ('struct power_supply') object after
> _unregister() (and irq handlers will surely do). Instead of removing
> free_irq(), the right fix would be to place the two calls before
> _unregister().

Thanks for the feedback.  I will send a new patch.

julia

[PATCH] drivers/power/88pm860x_battery.c: eliminate possible references to released resources

[Julia Lawall]

From: Julia Lawall <Julia.Lawall@lip6.fr>

devm_kzalloc should not be followed by kfree, as this results in a double
free.  The problem was found using the following semantic match
(http://coccinelle.lip6.fr/):

// <smpl>
@@
expression x,e;
@@
x = devm_kzalloc(...)
... when != x = e
?-kfree(x,...);
// </smpl>

Furthermore, in the remove function, the calls to free_irq are moved up to
prevent a possible reference in the interrupt handler to resources freed by
power_supply_unregister.

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>

---
V2, moving up the calls to free_irq, instead of removing them and using
devm_request_threaded_irq.

  drivers/power/88pm860x_battery.c |   13 ++++---------
  1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/drivers/power/88pm860x_battery.c b/drivers/power/88pm860x_battery.c
index 8bc80b0..d338c1c 100644
--- a/drivers/power/88pm860x_battery.c
+++ b/drivers/power/88pm860x_battery.c
@@ -915,15 +915,13 @@ static int pm860x_battery_probe(struct platform_device *pdev)
  	info->irq_cc = platform_get_irq(pdev, 0);
  	if (info->irq_cc <= 0) {
  		dev_err(&pdev->dev, "No IRQ resource!\n");
-		ret = -EINVAL;
-		goto out;
+		return -EINVAL;
  	}

  	info->irq_batt = platform_get_irq(pdev, 1);
  	if (info->irq_batt <= 0) {
  		dev_err(&pdev->dev, "No IRQ resource!\n");
-		ret = -EINVAL;
-		goto out;
+		return -EINVAL;
  	}

  	info->chip = chip;
@@ -957,7 +955,7 @@ static int pm860x_battery_probe(struct platform_device *pdev)

  	ret = power_supply_register(&pdev->dev, &info->battery);
  	if (ret)
-		goto out;
+		return ret;
  	info->battery.dev->parent = &pdev->dev;

  	ret = request_threaded_irq(info->irq_cc, NULL,
@@ -984,8 +982,6 @@ out_coulomb:
  	free_irq(info->irq_cc, info);
  out_reg:
  	power_supply_unregister(&info->battery);
-out:
-	kfree(info);
  	return ret;
  }

@@ -993,10 +989,9 @@ static int pm860x_battery_remove(struct platform_device *pdev)
  {
  	struct pm860x_battery_info *info = platform_get_drvdata(pdev);

-	power_supply_unregister(&info->battery);
  	free_irq(info->irq_batt, info);
  	free_irq(info->irq_cc, info);
-	kfree(info);
+	power_supply_unregister(&info->battery);
  	platform_set_drvdata(pdev, NULL);
  	return 0;
  }

Re: [PATCH] drivers/power/88pm860x_battery.c: eliminate possible references to released resources

[Anton Vorontsov]

On Sun, Jan 06, 2013 at 09:43:10AM +0100, Julia Lawall wrote:
> From: Julia Lawall <Julia.Lawall@lip6.fr>
> 
> devm_kzalloc should not be followed by kfree, as this results in a double
> free.  The problem was found using the following semantic match
> (http://coccinelle.lip6.fr/):
> 
> // <smpl>
> @@
> expression x,e;
> @@
> x = devm_kzalloc(...)
> ... when != x = e
> ?-kfree(x,...);
> // </smpl>
> 
> Furthermore, in the remove function, the calls to free_irq are moved up to
> prevent a possible reference in the interrupt handler to resources freed by
> power_supply_unregister.
> 
> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
> 
> ---
> V2, moving up the calls to free_irq, instead of removing them and using
> devm_request_threaded_irq.

The patch is whitespace-damaged (for some reason there are two spaces in
the beginning of each non-change line). I repeated changes manually, but
you might want to fix your mail/patch setup anyway. :)

Thanks.

>  drivers/power/88pm860x_battery.c |   13 ++++---------
>  1 file changed, 4 insertions(+), 9 deletions(-)
> 
> diff --git a/drivers/power/88pm860x_battery.c b/drivers/power/88pm860x_battery.c
> index 8bc80b0..d338c1c 100644
> --- a/drivers/power/88pm860x_battery.c
> +++ b/drivers/power/88pm860x_battery.c
> @@ -915,15 +915,13 @@ static int pm860x_battery_probe(struct platform_device *pdev)
>  	info->irq_cc = platform_get_irq(pdev, 0);
>  	if (info->irq_cc <= 0) {
>  		dev_err(&pdev->dev, "No IRQ resource!\n");
> -		ret = -EINVAL;
> -		goto out;
> +		return -EINVAL;
>  	}
> 
>  	info->irq_batt = platform_get_irq(pdev, 1);
>  	if (info->irq_batt <= 0) {
>  		dev_err(&pdev->dev, "No IRQ resource!\n");
> -		ret = -EINVAL;
> -		goto out;
> +		return -EINVAL;
>  	}
> 
>  	info->chip = chip;
> @@ -957,7 +955,7 @@ static int pm860x_battery_probe(struct platform_device *pdev)
> 
>  	ret = power_supply_register(&pdev->dev, &info->battery);
>  	if (ret)
> -		goto out;
> +		return ret;
>  	info->battery.dev->parent = &pdev->dev;
> 
>  	ret = request_threaded_irq(info->irq_cc, NULL,
> @@ -984,8 +982,6 @@ out_coulomb:
>  	free_irq(info->irq_cc, info);
>  out_reg:
>  	power_supply_unregister(&info->battery);
> -out:
> -	kfree(info);
>  	return ret;
>  }
> 
> @@ -993,10 +989,9 @@ static int pm860x_battery_remove(struct platform_device *pdev)
>  {
>  	struct pm860x_battery_info *info = platform_get_drvdata(pdev);
> 
> -	power_supply_unregister(&info->battery);
>  	free_irq(info->irq_batt, info);
>  	free_irq(info->irq_cc, info);
> -	kfree(info);
> +	power_supply_unregister(&info->battery);
>  	platform_set_drvdata(pdev, NULL);
>  	return 0;
>  }
> 

Re: [PATCH] drivers/power/88pm860x_battery.c: eliminate possible references to released resources

[Dan Carpenter]

On Sun, Jan 06, 2013 at 01:16:50PM -0800, Anton Vorontsov wrote:
> The patch is whitespace-damaged (for some reason there are two spaces in
> the beginning of each non-change line). I repeated changes manually, but
> you might want to fix your mail/patch setup anyway. :)
> 

It may be something on your end, the patch applies fine for me.

regards,
dan carpenter

Re: [PATCH] drivers/power/88pm860x_battery.c: eliminate possible references to released resources

[Julia Lawall]

On Mon, 7 Jan 2013, Dan Carpenter wrote:

> On Sun, Jan 06, 2013 at 01:16:50PM -0800, Anton Vorontsov wrote:
> > The patch is whitespace-damaged (for some reason there are two spaces in
> > the beginning of each non-change line). I repeated changes manually, but
> > you might want to fix your mail/patch setup anyway. :)
> > 
> 
> It may be something on your end, the patch applies fine for me.

There was a problem on my end and I fixed it.

thanks,
julia

Re: [PATCH] drivers/power/88pm860x_battery.c: eliminate possible references to released resources

[Anton Vorontsov]

On Mon, Jan 07, 2013 at 09:42:23AM +0300, Dan Carpenter wrote:
> On Sun, Jan 06, 2013 at 01:16:50PM -0800, Anton Vorontsov wrote:
> > The patch is whitespace-damaged (for some reason there are two spaces in
> > the beginning of each non-change line). I repeated changes manually, but
> > you might want to fix your mail/patch setup anyway. :)
> > 
> 
> It may be something on your end, the patch applies fine for me.

I just looked into Julia's email headers, and it says:

  Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed

flowed? for the patch? :) That's not right.

Documentation/email-clients.txt says:

  Don't send patches with "format=flowed".  This can cause unexpected
  and unwanted line breaks.

:-P

As for why it applied fine for you, your mailer probably automatically
decodes the content, but I apply mbox file directly. (If I '<ESC>-C' the
email in mutt, then it also applies for me, but I normally don't do that.)

Anton

Re: [PATCH] drivers/power/88pm860x_battery.c: eliminate possible references to released resources

[Dan Carpenter]

On Sun, Jan 06, 2013 at 10:53:21PM -0800, Anton Vorontsov wrote:
> On Mon, Jan 07, 2013 at 09:42:23AM +0300, Dan Carpenter wrote:
> > On Sun, Jan 06, 2013 at 01:16:50PM -0800, Anton Vorontsov wrote:
> > > The patch is whitespace-damaged (for some reason there are two spaces in
> > > the beginning of each non-change line). I repeated changes manually, but
> > > you might want to fix your mail/patch setup anyway. :)
> > > 
> > 
> > It may be something on your end, the patch applies fine for me.
> 
> I just looked into Julia's email headers, and it says:
> 
>   Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
> 
> flowed? for the patch? :) That's not right.
> 
> Documentation/email-clients.txt says:
> 
>   Don't send patches with "format=flowed".  This can cause unexpected
>   and unwanted line breaks.
> 
> :-P
> 
> As for why it applied fine for you, your mailer probably automatically
> decodes the content, but I apply mbox file directly. (If I '<ESC>-C' the
> email in mutt, then it also applies for me, but I normally don't do that.)

Ah.  You're right, of course.  I'm also using mutt but I have
<decode-copy> in my macros like you say.

macro index,pager ap "<shell-escape>rm -f tmp/patch<enter><decode-copy>tmp/patch<enter><shell-escape>~/progs/kernel/apply_patch.sh ~/var/mail/tmp/patch<enter>"

When I pipe to scripts it uses the undecoded copy.  I wish I knew
how to use the decoded version there as well...

regards,
dan carpenter

Re: [PATCH] drivers/power/88pm860x_battery.c: eliminate possible references to released resources

[Julia Lawall]

On Sun, 6 Jan 2013, Anton Vorontsov wrote:

> On Mon, Jan 07, 2013 at 09:42:23AM +0300, Dan Carpenter wrote:
> > On Sun, Jan 06, 2013 at 01:16:50PM -0800, Anton Vorontsov wrote:
> > > The patch is whitespace-damaged (for some reason there are two spaces in
> > > the beginning of each non-change line). I repeated changes manually, but
> > > you might want to fix your mail/patch setup anyway. :)
> > >
> >
> > It may be something on your end, the patch applies fine for me.
>
> I just looked into Julia's email headers, and it says:
>
>   Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
>
> flowed? for the patch? :) That's not right.
>
> Documentation/email-clients.txt says:
>
>   Don't send patches with "format=flowed".  This can cause unexpected
>   and unwanted line breaks.

That is what I fixed.  I had used that mailer before for sending patches,
and even fixed the problem before, so I have no idea why it changed...
But it is fixed now.

thanks,
julia