linux-kernel - Questions about drivers/mfd/mfd-core.c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 21 Sep 2020 07:34:52 +0000
From:   冯锐 <rui_feng@...lsil.com.cn>
To:     "lee.jones@...aro.org" <lee.jones@...aro.org>
CC:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "Arnd Bergmann" <arnd@...db.de>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: Questions about drivers/mfd/mfd-core.c

Hi Jones,

I have a question about drivers/mfd/mfd-core.c and need your help.
The driver in drivers/misc/cardreader/rtsx_pcr.c call 'mfd_add_devices' and 'mfd_remove_devices' in probe and remove functions
Before Linus 5.9-rc1, the two functions can run properly, but in Linus 5.9-rc1 when I unplug the cardreader 'mfd_remove_devices' will lead to a kernel bug like below:

------------[ cut here ]------------
kernel BUG at mm/slub.c:304!
invalid opcode: 0000 [#1] SMP PTI
CPU: 0 PID: 7 Comm: kworker/u8:0 Not tainted 5.8.0+ #11
Hardware name: Dell Inc. Latitude E5440/0RT36Y, BIOS A04 01/22/2014
Workqueue: kacpi_hotplug acpi_hotplug_work_fn
RIP: 0010:__slab_free+0x1aa/0x350
Code: 0f 1f 44 00 00 eb a5 41 f7 46 08 00 0d 21 00 0f 85 16 ff ff ff 4d 85 ed 0f 85 0d ff ff ff 80 4d bb 80 45 31 c0 e9 60 ff ff ff <0f> 0b 49 3b 5c 24 28 75 c5 48 8b 45 88 49 89 4c 24 28 49 89 44 24
RSP: 0018:ffffb658c0057a20 EFLAGS: 00010246
RAX: ffff988a546bf5a0 RBX: 0000000080150011 RCX: ffff988a546bf540
RDX: ffff988a546bf540 RSI: ffffe3274451afc0 RDI: ffff988a6a042800
RBP: ffffb658c0057ac0 R08: 0000000000000001 R09: ffffffffa9136a52
R10: 0000000000000001 R11: 0000000000000000 R12: ffffe3274451afc0
R13: ffff988a546bf540 R14: ffff988a6a042800 R15: ffff988a546bf540
FS:  0000000000000000(0000) GS:ffff988a6aa00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f03bc003d04 CR3: 000000009840a001 CR4: 00000000001706f0
Call Trace:
 ? __kernfs_remove.part.18+0x101/0x1f0
 ? platform_device_release+0x22/0x50
 kfree+0x34f/0x390
 ? kfree+0x34f/0x390
 platform_device_release+0x22/0x50
 device_release+0x2c/0x80
 kobject_put+0xad/0x1c0
 ? device_links_flush_sync_list+0xe0/0xe0
 klist_children_put+0x1a/0x20
 klist_prev+0xa6/0x130
 ? mfd_cell_disable+0x50/0x50
 device_for_each_child_reverse+0x60/0x90
 mfd_remove_devices+0x33/0x50
 rtsx_pci_remove+0x85/0x180 [rtsx_pci]
 pci_device_remove+0x3e/0xc0
 device_release_driver_internal+0xfb/0x1c0
 device_release_driver+0x12/0x20
 pci_stop_bus_device+0x68/0x90
 pci_stop_and_remove_bus_device+0x12/0x20
 trim_stale_devices+0x167/0x190
 trim_stale_devices+0xa9/0x190
 acpiphp_check_bridge.part.15+0x100/0x140
 acpiphp_check_host_bridge+0x98/0xc0
 acpi_pci_root_scan_dependent+0xe/0x20
 acpi_scan_bus_check+0x3f/0xc0
 acpi_device_hotplug+0x2af/0x4b0
 acpi_hotplug_work_fn+0x1e/0x30
 process_one_work+0x20c/0x400
 worker_thread+0x34/0x400
 ? process_one_work+0x400/0x400
 kthread+0x126/0x140
 ? kthread_park+0x90/0x90
 ret_from_fork+0x22/0x30

After I revert the commit 466a62d7642f02f36d37d9b30c19a725538a01ca(https://lore.kernel.org/patchwork/patch/1255106), 'mfd_remove_devices' will run without bug,
Do I use 'mfd_add_devices' and 'mfd_remove_devices' incorrectly or possible bug in drivers/mfd/mfd-core.c? I don't know what's wrong, so I need your help.
If you need more information please let me know.

Thanks

Rui Feng