From: Tilman Schmidt <tilman@imap.cc>
To: Paul Bolle <pebolle@tiscali.nl>,
Peter Hurley <peter@hurleysoftware.com>,
Sasha Levin <sasha.levin@oracle.com>
Cc: isdn@linux-pingi.de, davem@davemloft.net,
gigaset307x-common@lists.sourceforge.net,
LKML <linux-kernel@vger.kernel.org>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
syzkaller <syzkaller@googlegroups.com>
Subject: Re: gigaset: freeing an active object
Date: Sun, 6 Dec 2015 16:29:32 +0100 [thread overview]
Message-ID: <5664545C.90607@imap.cc> (raw)
In-Reply-To: <1449408690.2515.15.camel@tiscali.nl>
[-- Attachment #1: Type: text/plain, Size: 3207 bytes --]
Am 06.12.2015 um 14:31 schrieb Paul Bolle:
> On wo, 2015-12-02 at 18:48 -0500, Peter Hurley wrote:
>> On 11/30/2015 01:01 PM, Paul Bolle wrote:
>>> --- a/drivers/isdn/gigaset/ser-gigaset.c
>>> +++ b/drivers/isdn/gigaset/ser-gigaset.c
>>> @@ -42,8 +42,9 @@ MODULE_PARM_DESC(cidmode, "stay in CID mode when
>>> idle");
>>>
>>> static struct gigaset_driver *driver;
>>>
>>> +static struct platform_device pdev;
>>> +
>>> struct ser_cardstate {
>>> - struct platform_device dev;
>>> struct tty_struct *tty;
>>> atomic_t refcnt;
>>> struct completion dead_cmp;
>>> @@ -370,8 +371,8 @@ static void gigaset_freecshw(struct cardstate
>>> *cs)
>>> tasklet_kill(&cs->write_tasklet);
>>> if (!cs->hw.ser)
>>> return;
>>> - dev_set_drvdata(&cs->hw.ser->dev.dev, NULL);
>>> - platform_device_unregister(&cs->hw.ser->dev);
>>> + dev_set_drvdata(&pdev.dev, NULL);
>>> + platform_device_unregister(&pdev);
>>> kfree(cs->hw.ser);
>>
>> Tilman,
>>
>> Is there a 1:1 correspondence and lifetime for the embedded platform
>> device and it's containing memory?
>
> (Haven't heard from Tilman, so I'll give this a try.)
Sorry for that. Been busy.
> That containing memory is a struct ser_cardstate. And currently
> instances of struct _ser_cardstate are malloced and freed in routines
> that also call platform_device_register() and
> platform_device_unregister(). So yes, I think there's a 1:1
> correspondence.
Correct.
>> I ask because the typical approach for device teardown is to put the
>> kfree() in the release method;
>
> (Side note: the (struct device) release method of this driver
> -gigaset_device_release() - is actually a nop. It only frees device
> ->platform_data and platform_device->resource, but neither are actually
> used: they remain NULL through their entire life.)
Yeah, that was just copied unthinkingly from driver/base/platform.c.
So the solution might be as simple as moving the kfree() call from
gigaset_freecshw() to gigaset_device_release(). Something like this:
--- a/drivers/isdn/gigaset/ser-gigaset.c
+++ b/drivers/isdn/gigaset/ser-gigaset.c
@@ -370,19 +370,18 @@ static void gigaset_freecshw(struct cardstate *cs)
tasklet_kill(&cs->write_tasklet);
if (!cs->hw.ser)
return;
- dev_set_drvdata(&cs->hw.ser->dev.dev, NULL);
platform_device_unregister(&cs->hw.ser->dev);
- kfree(cs->hw.ser);
- cs->hw.ser = NULL;
}
static void gigaset_device_release(struct device *dev)
{
- struct platform_device *pdev = to_platform_device(dev);
+ struct cardstate *cs = dev_get_drvdata(dev);
- /* adapted from platform_device_release() in
drivers/base/platform.c */
- kfree(dev->platform_data);
- kfree(pdev->resource);
+ if (!cs)
+ return;
+ dev_set_drvdata(dev, NULL);
+ kfree(cs->hw.ser);
+ cs->hw.ser = NULL;
}
/*
(Off the top of my hat, completely untested, don't even know if that
will compile.)
--
Tilman Schmidt E-Mail: tilman@imap.cc
Bonn, Germany
Nous, on a des fleurs et des bougies pour nous protéger.
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 473 bytes --]
next prev parent reply other threads:[~2015-12-06 15:29 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-11-27 15:19 gigaset: freeing an active object Sasha Levin
2015-11-27 17:57 ` Paul Bolle
2015-11-27 18:15 ` Sasha Levin
2015-11-28 0:28 ` Paul Bolle
2015-11-28 1:20 ` Peter Hurley
2015-11-28 1:27 ` Sasha Levin
2015-11-29 14:36 ` Dmitry Vyukov
2015-11-29 15:30 ` Tilman Schmidt
2015-11-29 18:22 ` Peter Hurley
2015-11-29 18:38 ` Tilman Schmidt
2015-11-29 18:47 ` Tilman Schmidt
2015-11-29 20:26 ` Paul Bolle
2015-11-29 23:23 ` Paul Bolle
2015-11-30 18:01 ` Paul Bolle
2015-11-30 18:30 ` Tilman Schmidt
2015-11-30 21:07 ` Paul Bolle
2015-12-01 9:30 ` Tilman Schmidt
2015-12-01 10:05 ` Paul Bolle
2015-12-02 23:48 ` Peter Hurley
2015-12-06 13:31 ` Paul Bolle
2015-12-06 15:29 ` Tilman Schmidt [this message]
2015-12-06 20:12 ` Paul Bolle
2015-12-07 9:27 ` Tilman Schmidt
2015-12-07 12:25 ` Paul Bolle
2015-12-07 18:40 ` Tilman Schmidt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5664545C.90607@imap.cc \
--to=tilman@imap.cc \
--cc=davem@davemloft.net \
--cc=gigaset307x-common@lists.sourceforge.net \
--cc=isdn@linux-pingi.de \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pebolle@tiscali.nl \
--cc=peter@hurleysoftware.com \
--cc=sasha.levin@oracle.com \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).