From patchwork Tue Nov 18 14:09:16 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jiri Slaby X-Patchwork-Id: 41034 Return-Path: X-Original-To: linaro@patches.linaro.org Delivered-To: linaro@patches.linaro.org Received: from mail-wi0-f199.google.com (mail-wi0-f199.google.com [209.85.212.199]) by ip-10-151-82-157.ec2.internal (Postfix) with ESMTPS id E9DE024035 for ; Tue, 18 Nov 2014 14:18:00 +0000 (UTC) Received: by mail-wi0-f199.google.com with SMTP id bs8sf2538444wib.10 for ; Tue, 18 Nov 2014 06:18:00 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:delivered-to:from:to:cc:subject :date:message-id:in-reply-to:references:in-reply-to:references :sender:precedence:list-id:x-original-sender :x-original-authentication-results:mailing-list:list-post:list-help :list-archive:list-unsubscribe; bh=BUeCW08eX1d2vZ7mir16ekGM/6hF/tYTBEHxWURY4Mk=; b=Jyt2GGdD+C7M24scjrkV20oWfN5qNXhBuPKjpz4ocJGaJtxew29aJgJ48TykNFLvL1 hWlySWRaRoSIeQpwVBH4qpRpeeOuhANp6kd12I4YBnAnZYE7ySrSJ3to7EXSeyw09uWC dVBtFU2Xik75Lx+0s5hRlMqyzAfIRNncuGwS+XNHna8scASkhLlXLAQeH+lgwTLqU0dy +8/dXLTFSTZ5C3XupLNWdP5QoE2IkNWM29F1eRFZ6vXEIr1HHG/WamXpxTH/qOX6Eo29 Yc7lZayb47fb0J3l5nxcsCl68XY0Ug6sza3F+s9MqBaubU8n3iPMPKAbwSppB1kceTc3 VjSA== X-Gm-Message-State: ALoCoQkiVsygClz2CQgbhSv/M4HJnWnOxUs9TpRMGlvvIyOs/WpCN3q96i8AVz9LMq5NsgVrD2d0 X-Received: by 10.180.182.164 with SMTP id ef4mr5752169wic.0.1416320280163; Tue, 18 Nov 2014 06:18:00 -0800 (PST) MIME-Version: 1.0 X-BeenThere: patchwork-forward@linaro.org Received: by 10.152.5.7 with SMTP id o7ls861229lao.55.gmail; Tue, 18 Nov 2014 06:17:59 -0800 (PST) X-Received: by 10.152.30.70 with SMTP id q6mr5364937lah.6.1416320279712; Tue, 18 Nov 2014 06:17:59 -0800 (PST) Received: from mail-lb0-f171.google.com (mail-lb0-f171.google.com. [209.85.217.171]) by mx.google.com with ESMTPS id sn3si39082390lbb.77.2014.11.18.06.17.59 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 18 Nov 2014 06:17:59 -0800 (PST) Received-SPF: pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.217.171 as permitted sender) client-ip=209.85.217.171; Received: by mail-lb0-f171.google.com with SMTP id b6so17822847lbj.16 for ; Tue, 18 Nov 2014 06:17:59 -0800 (PST) X-Received: by 10.152.116.102 with SMTP id jv6mr23013181lab.40.1416320279619; Tue, 18 Nov 2014 06:17:59 -0800 (PST) X-Forwarded-To: patchwork-forward@linaro.org X-Forwarded-For: patch@linaro.org patchwork-forward@linaro.org Delivered-To: patch@linaro.org Received: by 10.112.184.201 with SMTP id ew9csp1335457lbc; Tue, 18 Nov 2014 06:17:58 -0800 (PST) X-Received: by 10.66.192.42 with SMTP id hd10mr27358008pac.55.1416320277534; Tue, 18 Nov 2014 06:17:57 -0800 (PST) Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id k5si2310767pdj.25.2014.11.18.06.17.56 for ; Tue, 18 Nov 2014 06:17:57 -0800 (PST) Received-SPF: none (google.com: linux-kernel-owner@vger.kernel.org does not designate permitted sender hosts) client-ip=209.132.180.67; Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755641AbaKRORI (ORCPT + 26 others); Tue, 18 Nov 2014 09:17:08 -0500 Received: from cantor2.suse.de ([195.135.220.15]:57087 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755013AbaKROK1 (ORCPT ); Tue, 18 Nov 2014 09:10:27 -0500 Received: from relay1.suse.de (charybdis-ext.suse.de [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id 83185AE5C; Tue, 18 Nov 2014 14:09:25 +0000 (UTC) Received: from ku by ip4-83-240-18-248.cust.nbox.cz with local (Exim 4.83) (envelope-from ) id 1XqjTB-00027x-2o; Tue, 18 Nov 2014 15:09:25 +0100 From: Jiri Slaby To: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Yijing Wang , Weng Meiling , Jiri Slaby Subject: [PATCH 3.12 201/206] sysfs: driver core: Fix glue dir race condition by gdp_mutex Date: Tue, 18 Nov 2014 15:09:16 +0100 Message-Id: X-Mailer: git-send-email 2.1.3 In-Reply-To: <28f04bcc068a44c5641c727883947960fb8dcbd5.1416319692.git.jslaby@suse.cz> References: <28f04bcc068a44c5641c727883947960fb8dcbd5.1416319692.git.jslaby@suse.cz> In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org Precedence: list List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Removed-Original-Auth: Dkim didn't pass. X-Original-Sender: linux-kernel-owner@vger.kernel.org X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.217.171 as permitted sender) smtp.mail=patch+caf_=patchwork-forward=linaro.org@linaro.org Mailing-list: list patchwork-forward@linaro.org; contact patchwork-forward+owners@linaro.org X-Google-Group-Id: 836684582541 List-Post: , List-Help: , List-Archive: List-Unsubscribe: , From: Yijing Wang 3.12-stable review patch. If anyone has any objections, please let me know. =============== commit e4a60d139060975eb956717e4f63ae348d4d8cc5 upstream. There is a race condition when removing glue directory. It can be reproduced in following test: path 1: Add first child device device_add() get_device_parent() /*find parent from glue_dirs.list*/ list_for_each_entry(k, &dev->class->p->glue_dirs.list, entry) if (k->parent == parent_kobj) { kobj = kobject_get(k); break; } .... class_dir_create_and_add() path2: Remove last child device under glue dir device_del() cleanup_device_parent() cleanup_glue_dir() kobject_put(glue_dir); If path2 has been called cleanup_glue_dir(), but not call kobject_put(glue_dir), the glue dir is still in parent's kset list. Meanwhile, path1 find the glue dir from the glue_dirs.list. Path2 may release glue dir before path1 call kobject_get(). So kernel will report the warning and bug_on. This is a "classic" problem we have of a kref in a list that can be found while the last instance could be removed at the same time. This patch reuse gdp_mutex to fix this race condition. The following calltrace is captured in kernel 3.4, but the latest kernel still has this bug. ----------------------------------------------------- <4>[ 3965.441471] WARNING: at ...include/linux/kref.h:41 kobject_get+0x33/0x40() <4>[ 3965.441474] Hardware name: Romley <4>[ 3965.441475] Modules linked in: isd_iop(O) isd_xda(O)... ... <4>[ 3965.441605] Call Trace: <4>[ 3965.441611] [] warn_slowpath_common+0x7a/0xb0 <4>[ 3965.441615] [] warn_slowpath_null+0x15/0x20 <4>[ 3965.441618] [] kobject_get+0x33/0x40 <4>[ 3965.441624] [] get_device_parent.isra.11+0x135/0x1f0 <4>[ 3965.441627] [] device_add+0xd4/0x6d0 <4>[ 3965.441631] [] ? dev_set_name+0x3c/0x40 .... <2>[ 3965.441912] kernel BUG at ..../fs/sysfs/group.c:65! <4>[ 3965.441915] invalid opcode: 0000 [#1] SMP ... <4>[ 3965.686743] [] sysfs_create_group+0xe/0x10 <4>[ 3965.686748] [] blk_trace_init_sysfs+0x14/0x20 <4>[ 3965.686753] [] blk_register_queue+0x3b/0x120 <4>[ 3965.686756] [] add_disk+0x1cc/0x490 .... ------------------------------------------------------- Signed-off-by: Yijing Wang Signed-off-by: Weng Meiling Signed-off-by: Jiri Slaby --- drivers/base/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/base/core.c b/drivers/base/core.c index 34abf4d8a45f..944fecd32e9f 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c @@ -812,12 +812,12 @@ class_dir_create_and_add(struct class *class, struct kobject *parent_kobj) return &dir->kobj; } +static DEFINE_MUTEX(gdp_mutex); static struct kobject *get_device_parent(struct device *dev, struct device *parent) { if (dev->class) { - static DEFINE_MUTEX(gdp_mutex); struct kobject *kobj = NULL; struct kobject *parent_kobj; struct kobject *k; @@ -881,7 +881,9 @@ static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir) glue_dir->kset != &dev->class->p->glue_dirs) return; + mutex_lock(&gdp_mutex); kobject_put(glue_dir); + mutex_unlock(&gdp_mutex); } static void cleanup_device_parent(struct device *dev)