Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1397980 > unrolled thread

[PATCH 0/2] MCB: two additional fixes for v4.7

Back to article view | Back to linux.kernel

Contents

  [PATCH 0/2] MCB: two additional fixes for v4.7 Johannes Thumshirn <jthumshirn@suse.de> - 2016-05-10 12:50 +0200
    [PATCH 2/2] mcb: Acquire reference to carrier module in core Johannes Thumshirn <jthumshirn@suse.de> - 2016-05-10 12:50 +0200
    [PATCH 1/2] mcb: Acquire reference to device in probe Johannes Thumshirn <jthumshirn@suse.de> - 2016-05-10 12:50 +0200

#1397980 — [PATCH 0/2] MCB: two additional fixes for v4.7

Hi Greg,

Here are two additional fixes for MCB from me, which would be good to have in
v4.7.

One fixes a panic when doing a insmod/rmmod loop and one grabs a reference to
the carrier driver's module as long as client drivers are loaded.

Both bugs have been reported by Andy and he tested the fixes as well.

Sorry for being so close to the merge window.

Johannes Thumshirn (2):
  mcb: Acquire reference to device in probe
  mcb: Acquire reference to carrier module in core

 drivers/mcb/mcb-core.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

-- 
2.8.1

[toc] | [next] | [standalone]

#1397981 — [PATCH 2/2] mcb: Acquire reference to carrier module in core

Acquire a reference to the carrier's kernel module in bus code, so
it can't be removed from the kernel while it still has a bus and thus
possibly devices attached to it.

Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
Reported-by: Andreas Werner <andreas.werner@men.de>
Tested-by: Andreas Werner <andreas.werner@men.de>
---
 drivers/mcb/mcb-core.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/drivers/mcb/mcb-core.c b/drivers/mcb/mcb-core.c
index f5923c2..6f2c852 100644
--- a/drivers/mcb/mcb-core.c
+++ b/drivers/mcb/mcb-core.c
@@ -61,22 +61,36 @@ static int mcb_probe(struct device *dev)
 	struct mcb_driver *mdrv = to_mcb_driver(dev->driver);
 	struct mcb_device *mdev = to_mcb_device(dev);
 	const struct mcb_device_id *found_id;
+	struct module *carrier_mod;
+	int ret;
 
 	found_id = mcb_match_id(mdrv->id_table, mdev);
 	if (!found_id)
 		return -ENODEV;
 
+	carrier_mod = mdev->dev.parent->driver->owner;
+	if (!try_module_get(carrier_mod))
+		return -EINVAL;
+
 	get_device(dev);
-	return mdrv->probe(mdev, found_id);
+	ret = mdrv->probe(mdev, found_id);
+	if (ret)
+		module_put(carrier_mod);
+
+	return ret;
 }
 
 static int mcb_remove(struct device *dev)
 {
 	struct mcb_driver *mdrv = to_mcb_driver(dev->driver);
 	struct mcb_device *mdev = to_mcb_device(dev);
+	struct module *carrier_mod;
 
 	mdrv->remove(mdev);
 
+	carrier_mod = mdev->dev.parent->driver->owner;
+	module_put(carrier_mod);
+
 	put_device(&mdev->dev);
 
 	return 0;
-- 
2.8.1

[toc] | [prev] | [next] | [standalone]

#1397984 — [PATCH 1/2] mcb: Acquire reference to device in probe

mcb_probe() does not aqcuire a reference to the probed device but drops one
when removing the device. As it is actually using the device, it should grab
a reference via get_device().

This could lead to a panic found with a rmmod/modprobe stress test

Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
Reported-by: Andreas Werner <andreas.werner@men.de>
Tested-by: Andreas Werner <andreas.werner@men.de>
---
 drivers/mcb/mcb-core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mcb/mcb-core.c b/drivers/mcb/mcb-core.c
index b73c6e7..f5923c2 100644
--- a/drivers/mcb/mcb-core.c
+++ b/drivers/mcb/mcb-core.c
@@ -66,6 +66,7 @@ static int mcb_probe(struct device *dev)
 	if (!found_id)
 		return -ENODEV;
 
+	get_device(dev);
 	return mdrv->probe(mdev, found_id);
 }
 
-- 
2.8.1

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web