linux-kernel - Re: [PATCH] usb: ulpi: call put_device if device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150722213934.GA10425@kroah.com>
Date:	Wed, 22 Jul 2015 14:39:34 -0700
From:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:	Heikki Krogerus <heikki.krogerus@...ux.intel.com>
Cc:	ChengYi He <chengyihetaipei@...il.com>,
	Felipe Balbi <balbi@...com>, linux-usb@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] usb: ulpi: call put_device if device_register fails

On Tue, Jun 23, 2015 at 01:57:38PM +0300, Heikki Krogerus wrote:
> On Fri, Jun 19, 2015 at 01:12:36AM +0800, ChengYi He wrote:
> > put_device is required to release the last reference to the device.
> > 
> > Signed-off-by: ChengYi He <chengyihetaipei@...il.com>
> > ---
> >  drivers/usb/common/ulpi.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c
> > index 0e6f968..bd25bdb 100644
> > --- a/drivers/usb/common/ulpi.c
> > +++ b/drivers/usb/common/ulpi.c
> > @@ -184,8 +184,10 @@ static int ulpi_register(struct device *dev, struct ulpi *ulpi)
> >  	request_module("ulpi:v%04xp%04x", ulpi->id.vendor, ulpi->id.product);
> >  
> >  	ret = device_register(&ulpi->dev);
> > -	if (ret)
> > +	if (ret) {
> > +		put_device(&ulpi->dev);
> 
> If device_register returns failure, put_device has already been
> called. Check device_add in drivers/base/core.c.

Yes, please read the function, which says:
 * NOTE: _Never_ directly free @dev after calling this function, even
 * if it returned an error! Always use put_device() to give up your
 * reference instead.

But, the problem is that the ulpi core doesn't "own" that struct device.
It comes from elsewhere.  It comes from somewhere deep down in the dw3
core, which is where I lost the path.  Something needs to be fixed in
dwc3_probe() to properly clean up the device if it fails, which is not
happening right now.

So this patch would actually cause much bigger problems than fixing
anything, so it's wrong, but for a different reason than you are talking
about here.

And ugh, the ulpi and dwc code binding together, what a mess, horrid...

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/