Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1332932
| From | Alexander Shishkin <alexander.shishkin@linux.intel.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [QUEUED v20160212 16/19] stm class: Fix unbalanced module/device refcounting |
| Date | 2016-02-12 18:20 +0100 |
| Message-ID | <r1pxU-1vA-11@gated-at.bofh.it> (permalink) |
| References | <r1poe-1rA-7@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
STM code takes references to the stm device and its module for the
duration of the character device's existence or the stm_source link.
Dropping these references is not well balanced everywhere, which may
lead to leaks.
This patch balances the acquisition and releasing of these two
references and annotates each site so that it's easier to verify
correctness by reading the code.
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
---
drivers/hwtracing/stm/core.c | 20 ++++++++++++++------
1 file changed, 14 insertions(+), 6 deletions(-)
diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
index 6a254ce4b9..0144ded45b 100644
--- a/drivers/hwtracing/stm/core.c
+++ b/drivers/hwtracing/stm/core.c
@@ -113,6 +113,7 @@ struct stm_device *stm_find_device(const char *buf)
stm = to_stm_device(dev);
if (!try_module_get(stm->owner)) {
+ /* matches class_find_device() above */
put_device(dev);
return NULL;
}
@@ -125,7 +126,7 @@ struct stm_device *stm_find_device(const char *buf)
* @stm: stm device, previously acquired by stm_find_device()
*
* This drops the module reference and device reference taken by
- * stm_find_device().
+ * stm_find_device() or stm_char_open().
*/
void stm_put_device(struct stm_device *stm)
{
@@ -365,6 +366,8 @@ static int stm_char_open(struct inode *inode, struct file *file)
return nonseekable_open(inode, file);
err_free:
+ /* matches class_find_device() above */
+ put_device(dev);
kfree(stmf);
return err;
@@ -375,6 +378,11 @@ static int stm_char_release(struct inode *inode, struct file *file)
struct stm_file *stmf = file->private_data;
stm_output_free(stmf->stm, &stmf->output);
+
+ /*
+ * matches the stm_char_open()'s
+ * class_find_device() + try_module_get()
+ */
stm_put_device(stmf->stm);
kfree(stmf);
@@ -539,10 +547,8 @@ static int stm_char_policy_set_ioctl(struct stm_file *stmf, void __user *arg)
ret = stm->data->link(stm->data, stmf->output.master,
stmf->output.channel);
- if (ret) {
+ if (ret)
stm_output_free(stmf->stm, &stmf->output);
- stm_put_device(stmf->stm);
- }
err_free:
kfree(id);
@@ -679,6 +685,7 @@ int stm_register_device(struct device *parent, struct stm_data *stm_data,
return 0;
err_device:
+ /* matches device_initialize() above */
put_device(&stm->dev);
err_free:
kfree(stm);
@@ -791,7 +798,6 @@ static int stm_source_link_add(struct stm_source_device *src,
fail_free_output:
stm_output_free(stm, &src->output);
- stm_put_device(stm);
fail_detach:
mutex_lock(&stm->link_mutex);
@@ -905,8 +911,10 @@ static ssize_t stm_source_link_store(struct device *dev,
return -EINVAL;
err = stm_source_link_add(src, link);
- if (err)
+ if (err) {
+ /* matches the stm_find_device() above */
stm_put_device(link);
+ }
return err ? : count;
}
--
2.7.0
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[QUEUED v20160212 00/19] stm class/intel_th: Patches in my queue Alexander Shishkin <alexander.shishkin@linux.intel.com> - 2016-02-12 18:10 +0100 [QUEUED v20160212 01/19] stm class: Use a signed return type for stm_find_master_chan Alexander Shishkin <alexander.shishkin@linux.intel.com> - 2016-02-12 18:10 +0100 [QUEUED v20160212 04/19] intel_th: Update scratchpad bits according to enabled output activity Alexander Shishkin <alexander.shishkin@linux.intel.com> - 2016-02-12 18:10 +0100 [QUEUED v20160212 02/19] intel_th: Depend on HAS_IOMEM Alexander Shishkin <alexander.shishkin@linux.intel.com> - 2016-02-12 18:10 +0100 [QUEUED v20160212 07/19] intel_th: sth: Sanitize packet callback's return values Alexander Shishkin <alexander.shishkin@linux.intel.com> - 2016-02-12 18:10 +0100 [QUEUED v20160212 08/19] intel_th: Set root device's drvdata early Alexander Shishkin <alexander.shishkin@linux.intel.com> - 2016-02-12 18:10 +0100 [QUEUED v20160212 11/19] stm class: Support devices with multiple instances Alexander Shishkin <alexander.shishkin@linux.intel.com> - 2016-02-12 18:10 +0100 [QUEUED v20160212 03/19] intel_th: gth: Remove commented-out code Alexander Shishkin <alexander.shishkin@linux.intel.com> - 2016-02-12 18:10 +0100 [QUEUED v20160212 18/19] stm class: Plug stm device's unlink callback Alexander Shishkin <alexander.shishkin@linux.intel.com> - 2016-02-12 18:20 +0100 [QUEUED v20160212 16/19] stm class: Fix unbalanced module/device refcounting Alexander Shishkin <alexander.shishkin@linux.intel.com> - 2016-02-12 18:20 +0100 [QUEUED v20160212 19/19] stm class: dummy_stm: Add link callback for fault injection Alexander Shishkin <alexander.shishkin@linux.intel.com> - 2016-02-12 18:20 +0100 [QUEUED v20160212 12/19] stm class: dummy_stm: Create multiple devices Alexander Shishkin <alexander.shishkin@linux.intel.com> - 2016-02-12 18:20 +0100 [QUEUED v20160212 17/19] stm class: Fix a race in unlinking Alexander Shishkin <alexander.shishkin@linux.intel.com> - 2016-02-12 18:20 +0100 [QUEUED v20160212 15/19] stm class: Guard output assignment against concurrency Alexander Shishkin <alexander.shishkin@linux.intel.com> - 2016-02-12 18:20 +0100 [QUEUED v20160212 14/19] stm class: Fix unlocking braino in the error path Alexander Shishkin <alexander.shishkin@linux.intel.com> - 2016-02-12 18:20 +0100 [QUEUED v20160212 13/19] stm class: Add heartbeat stm source device Alexander Shishkin <alexander.shishkin@linux.intel.com> - 2016-02-12 18:20 +0100
csiph-web