From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756197AbbCRRII (ORCPT ); Wed, 18 Mar 2015 13:08:08 -0400 Received: from mx0b-000f0801.pphosted.com ([67.231.152.113]:34563 "EHLO mx0b-000f0801.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756003AbbCRRIF (ORCPT ); Wed, 18 Mar 2015 13:08:05 -0400 Message-ID: <5509B0EC.8030604@brocade.com> Date: Wed, 18 Mar 2015 17:07:56 +0000 From: Brian Russell User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Icedove/31.5.0 MIME-Version: 1.0 To: "Hans J. Koch" , Greg Kroah-Hartman CC: Subject: Re: [PATCH v2] uio: Fix uio driver to refcount device References: <5502B93A.6090506@brocade.com> In-Reply-To: <5502B93A.6090506@brocade.com> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.13.68,1.0.33,0.0.0000 definitions=2015-03-18_05:2015-03-18,2015-03-18,1970-01-01 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=7.0.1-1402240000 definitions=main-1503180155 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Responding to myself ... On 13/03/15 10:17, Brian Russell wrote: > Protect uio driver from crashing if its owner is hot unplugged while there > are open fds. > > Signed-off-by: Brian Russell > --- > drivers/uio/uio.c | 8 +++++++- > 1 file changed, 7 insertions(+), 1 deletion(-) > > diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c > index 6276f13..70ce015 100644 > --- a/drivers/uio/uio.c > +++ b/drivers/uio/uio.c > @@ -434,9 +434,11 @@ static int uio_open(struct inode *inode, struct file *filep) > goto out; > } > > + get_device(idev); > + This is bogus, idev is uio_device *, not device *. Turns out this patch only masked the crash I was seeing, so please ignore. Updated version to follow ... Thanks, Brian > if (!try_module_get(idev->owner)) { > ret = -ENODEV; > - goto out; > + goto err_module_get; > } > > listener = kmalloc(sizeof(*listener), GFP_KERNEL); > @@ -462,6 +464,9 @@ err_infoopen: > err_alloc_listener: > module_put(idev->owner); > > +err_module_get: > + put_device(idev); > + > out: > return ret; > } > @@ -485,6 +490,7 @@ static int uio_release(struct inode *inode, struct file *filep) > > module_put(idev->owner); > kfree(listener); > + put_device(idev); > return ret; > } > >