Re: Is devm_* broken ?

[Takashi Iwai <tiwai@suse.de>]

On Wed, 15 Jul 2015 00:34:53 +0200,
Laurent Pinchart wrote:
> 
> Hello,
> 
> I came to realize not too long ago that the following sequence of events will 
> lead to a crash with any platform driver that uses devm_* and creates device 
> nodes.
> 
> 1. Get a platform device bound it its driver
> 2. Open the corresponding device node in userspace and keep it open
> 3. Unbind the platform device from its driver through sysfs
> 
> echo <device-name> > /sys/bus/platform/drivers/<driver-name>/unbind
> 
> (or for hotpluggable devices just unplug the device)
> 
> 4. Close the device node
> 5. Enjoy the fireworks
> 
> While having a device node open prevents modules from being unloaded, it 
> doesn't prevent devices from being unbound from drivers. If the driver uses 
> devm_* helpers to allocate memory the memory will be freed when the device is 
> unbound from the driver, but that memory will still be used by any operation 
> touching an open device node.
> 
> Is devm_* inherently broken ? It's so widely used, tell me I'm missing 
> something obvious.

I don't think this is specific to devm_*() but it's about the resource
management in general.  After bus or driver's remove callback, all
device resources that have been assigned by the driver are supposed to
be freed, or ready to be freed.


Takashi