[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <9e94f0fd-e2d5-4d9e-5759-a5f591191785@gmail.com>
Date: Tue, 21 Dec 2021 18:46:01 +0100
From: Rafał Miłecki <zajec5@...il.com>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: Srinivas Kandagatla <srinivas.kandagatla@...aro.org>,
Johan Hovold <johan@...nel.org>,
Andrey Smirnov <andrew.smirnov@...il.com>,
linux-kernel@...r.kernel.org,
Rafał Miłecki <rafal@...ecki.pl>
Subject: Re: [PATCH] nvmem: fix unregistering device in nvmem_register() error
path
On 21.12.2021 17:06, Greg Kroah-Hartman wrote:
> On Tue, Dec 21, 2021 at 04:45:50PM +0100, Rafał Miłecki wrote:
>> From: Rafał Miłecki <rafal@...ecki.pl>
>>
>> 1. Drop incorrect put_device() calls
>>
>> If device_register() fails then underlaying device_add() takes care of
>> calling put_device() if needed. There is no need to do that in a driver.
>
> Did you read the documentation for device_register() that says:
>
> * NOTE: _Never_ directly free @dev after calling this function, even
> * if it returned an error! Always use put_device() to give up the
> * reference initialized in this function instead.
I clearly tried to be too smart and ignored documentation.
I'd say device_add() behaviour is rather uncommon and a bit unintuitive.
Most kernel functions are safe to assume to do nothing that requires
cleanup if they fail.
E.g. if I call platform_device_register() and it fails I don't need to
call anything like platform_device_put(). I just free previously
allocated memory.
When calling device_register() / device_add() it seems device always
gets partially registered (even if it fails!). Enough to make it safe to
depend on core subsystem calling .release() after device_put().
So what initially looks like unbalanced device_put() call is actually
some device_add() specific magic behaviour ;)
Sorry. I should have checked documentation before posting patches.
That's not my best day.
>> 2. Use device_unregister()
>>
>> Now that we don't call put_device() we can use above helper.
>>
>> Fixes: 3360acdf8391 ("nvmem: core: fix leaks on registration errors")
>> Cc: Johan Hovold <johan@...nel.org>
>> Signed-off-by: Rafał Miłecki <rafal@...ecki.pl>
>> ---
>> That put_device() was explicitly added by Johan but after checking
>> device_register() twice I still think it's incorrect. I hope I didn't
>> miss sth obvious and I didn't mess it up.
>> ---
>> drivers/nvmem/core.c | 10 ++++------
>> 1 file changed, 4 insertions(+), 6 deletions(-)
>>
>> diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
>> index 785a56e33f69..f7f31af7226f 100644
>> --- a/drivers/nvmem/core.c
>> +++ b/drivers/nvmem/core.c
>> @@ -901,12 +901,12 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config)
>>
>> rval = device_register(&nvmem->dev);
>> if (rval)
>> - goto err_put_device;
>> + return ERR_PTR(rval);
>
> Where do you call put_device() to free the allocated memory?
>
> You just leaked the kzalloc() call to allocate the memory pointed to by
> nvmem :(
>
> I think the code is fine as-is.
Yeah, I forgot about:
ida_free(&nvmem_ida, nvmem->id);
kfree(nvmem);
Powered by blists - more mailing lists