linux-kernel - Re: [PATCH] PCI AER: pci_get_domain_bus_and_slot() call missing required pci_dev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 3 Dec 2012 13:01:52 -0700
From:	Shuah Khan <shuahkhan@...il.com>
To:	Alex Williamson <alex.williamson@...hat.com>
Cc:	Betty Dall <betty.dall@...com>, bhelgaas@...gle.com,
	linux-kernel@...r.kernel.org, linux-pci@...r.kernel.org,
	wangyijing@...wei.com, jiang.liu@...wei.com
Subject: Re: [PATCH] PCI AER: pci_get_domain_bus_and_slot() call missing
 required pci_dev_put()

On Mon, Dec 3, 2012 at 12:48 PM, Alex Williamson
<alex.williamson@...hat.com> wrote:
> On Mon, 2012-12-03 at 10:40 -0700, Shuah Khan wrote:
>> On Mon, Dec 3, 2012 at 9:37 AM, Betty Dall <betty.dall@...com> wrote:
>> > The function aer_recover_queue() makes a call to pci_get_domain_bus_and_slot().
>> > That function is documented to require that the caller decrement the
>> > reference count by calling pci_dev_put(). This patch adds the missing
>> > call to pci_dev_put().
>> >
>> > Signed-off-by: Betty Dall <betty.dall@...com>
>> > ---
>> >  drivers/pci/pcie/aer/aerdrv_core.c |    1 +
>> >  1 files changed, 1 insertions(+), 0 deletions(-)
>> >
>> > diff --git a/drivers/pci/pcie/aer/aerdrv_core.c b/drivers/pci/pcie/aer/aerdrv_core.c
>> > index af4e31c..43caf53 100644
>> > --- a/drivers/pci/pcie/aer/aerdrv_core.c
>> > +++ b/drivers/pci/pcie/aer/aerdrv_core.c
>> > @@ -616,6 +616,7 @@ static void aer_recover_work_func(struct work_struct *work)
>> >                         continue;
>> >                 }
>> >                 do_recovery(pdev, entry.severity);
>> > +               pci_dev_put(pdev);
>>
>> Are you sure pci_get_domain_bus_and_slot() does indeed increment the
>> reference count? I see that in the comments right above the
>> definition.
>>
>> pci_dev_get() does that for sure. I see a call trace of
>>
>> pci_dev_get() -> get_device() -> kobj_to_dev(kobject_get(&dev->kobj)  etc.
>>
>> and kref_get() finally incrementing the
>>
>> static inline void kref_get(struct kref *kref)
>> {
>>         WARN_ON(!atomic_read(&kref->refcount));
>>         atomic_inc(&kref->refcount);
>> }
>>
>> However, I could not find any evidence that
>> pci_get_domain_bus_and_slot() does that. I see
>> pci_get_domain_bus_and_slot() calling pci_domain_nr() and there are
>> several architecture specific defines for pci_domain_nr(). It is not
>> clear to me where does refcount get incremented from
>> pci_get_domain_bus_and_slot() is called.
>>
>> What am I missing?
>
> Trace back the for_each_pci_dev()
>
> for_each_pci_dev
>  -> pci_get_device
>   -> pci_get_subsys
>    -> pci_get_dev_by_id
>     -> bus_find_device
>      -> get_device()

Thanks. Didn't trace for_each_pci_dev()
>
> The real question is how many places do we call for_each_pci_dev()
> without a put.  It seems like pci_get_domain_bus_and_slot() doesn't even
> get it right since it should include a put of the non-matched devices.
> Thanks,
>

Probably several. I have seen only one or two cases pci_dev_put() is
called after pci_get_domain_bus_and_slot(). Did a quick search for
for_each_pci_dev() and found several instances that don't do
pci_dev_put()

-- Shuah
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/