From patchwork Mon Jun 4 14:14:08 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Srinivas Kandagatla X-Patchwork-Id: 137634 Delivered-To: patch@linaro.org Received: by 2002:a2e:970d:0:0:0:0:0 with SMTP id r13-v6csp1570727lji; Mon, 4 Jun 2018 07:16:21 -0700 (PDT) X-Google-Smtp-Source: ADUXVKKtuyMpOc/9Mw6DFsvOPXMjWzsJGQ4IQfagMHRVZXoCq9Nr1M0GVgpFNI/VmRS1YilZS7JN X-Received: by 2002:a63:6e4c:: with SMTP id j73-v6mr6129pgc.125.1528121780966; Mon, 04 Jun 2018 07:16:20 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1528121780; cv=none; d=google.com; s=arc-20160816; b=ufeHXBSUDVsF2P5W0WIO65vhYVxWTmw2uBv2JWDQogkT6MjhN11+zsGwXTxdu4Kqwu ZOIHQSJBuW8tkYxzfmluaJNJ6gcThbKP95z4Uc43w+TQ423T5yReteR7pFRn38BClw/D FmB5sGMkwoRt+1mEAl76h9siFvi3FBkNN1eAiwTkro42FSIyx+qwTCfiEZNUqAxmgKhu nT7E9nmLzDvNcUCTix3jKJ8f7DhQIpqxssV+/J0a9Kdwo5qwP/CLOuLAYsTbn6jgs8KK KDp99nyLU5BmKU4tm/e1XOwES3i2thN/xRRAjlGqGp3x/+AMfQk1F1vujVte90yh1jX8 ITyA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:message-id:date:subject:cc:to:from :dkim-signature:arc-authentication-results; bh=r4GaHhVz8O6eRGovNhyTPrxh/3lvD70XRWQy0Mo4F9w=; b=EUFniN+dt6KyMp8hOW/Qu3V01A9sHjli8qLeuY2GR6EgwYDpvtQ1YEbcFSoSn3/OJi RTGpMcnF5ftuE1EKUPQeavs0g9aG0Z9BwqsYl9NP2HRYPN3ZURzJypPJUJ9rIDy6E8EN T7ND8j1Re0XJNajUnXeJyXNDuMxj4Cs8TKtGgQw5k8QYBaXbxO/cDAPA6dhNYAP61Pf3 sgAkIFbaMsfPrQS7T2RWC5PVVy8qfZT/Sd/jFkacV59HP09D9C6ytNdL2sS8KpU8nxPf cUUdNjjV5qzqdSGCrMlaICkTh92BdJAdXvAGI34PzkIc6vwkQWCfBHkjCiiuv0ux2dN+ E8nA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=JICAgqw0; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id b2-v6si3758823pgt.611.2018.06.04.07.16.20; Mon, 04 Jun 2018 07:16:20 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=JICAgqw0; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753719AbeFDOQT (ORCPT + 30 others); Mon, 4 Jun 2018 10:16:19 -0400 Received: from mail-wr0-f193.google.com ([209.85.128.193]:35225 "EHLO mail-wr0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753245AbeFDOQQ (ORCPT ); Mon, 4 Jun 2018 10:16:16 -0400 Received: by mail-wr0-f193.google.com with SMTP id l10-v6so9103023wrn.2 for ; Mon, 04 Jun 2018 07:16:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id; bh=r4GaHhVz8O6eRGovNhyTPrxh/3lvD70XRWQy0Mo4F9w=; b=JICAgqw0l/sv4oS6MaLW+C0SICMWndTJ1Av1A7XpHsuiCk96MexoGv/ekyBIhW9c06 6PYWtLIWk5G//ky7Fg2CNlZC7GE+RlY6hjt39CtQxJmdNalKgV+UauLN3bh8Ie30MvxK 5ItbneJrLXcGoDDsN4W6izMrvCZzEM06VHz14= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=r4GaHhVz8O6eRGovNhyTPrxh/3lvD70XRWQy0Mo4F9w=; b=aFVYK0EUrLmfJ/Mj5zRYAMBE9XZh0vRy4SK+zYnHxOJusyutFbubbC1iAuzphxh5KG +nPdyCepvWT0BA9SUUbBdUcxvehrJWumQDWi1wxrRAAAiIURHDB5+nVijcvPyI0E4McY KG7wLia296Tj30hP2pMNHhj5BaX6vbPue+Ifyjm/96eBXcrHyDI5cfxEWcpGz9vnlDnL dw9haxeqsJYv8m0OsdsA/9Pjqz9yBB6RZYK4gtYf/pOFRcSyC7R6fTGiy537wnoL+Uz4 TssPVHHKG1izwP2MrX2jZMWUYwn3qVaK85fBHDsgqiv0kMEijB7Mwek8efZHxSPMPEXm 2toQ== X-Gm-Message-State: APt69E2ADOXqbIX5GbdEq30cnS8pFJvRLiqGkntW5YkU1yWFK3T4FWpG L24elLHJFBmF3CY97RJ5jsSRPg== X-Received: by 2002:adf:9582:: with SMTP id p2-v6mr1909326wrp.252.1528121774471; Mon, 04 Jun 2018 07:16:14 -0700 (PDT) Received: from localhost.localdomain (cpc90716-aztw32-2-0-cust92.18-1.cable.virginm.net. [86.26.100.93]) by smtp.gmail.com with ESMTPSA id v12-v6sm300889wmc.35.2018.06.04.07.16.13 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 04 Jun 2018 07:16:13 -0700 (PDT) From: Srinivas Kandagatla To: robh+dt@kernel.org, frowand.list@gmail.com Cc: linux-arm-msm@vger.kernel.org, bgoswami@codeaurora.org, devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, rohkumar@qti.qualcomm.com, Srinivas Kandagatla Subject: [PATCH v3] of: platform: stop accessing invalid dev in of_platform_device_destroy Date: Mon, 4 Jun 2018 15:14:08 +0100 Message-Id: <20180604141408.3179-1-srinivas.kandagatla@linaro.org> X-Mailer: git-send-email 2.16.2 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Immediately after the platform_device_unregister() the device will be cleaned up. Accessing the freed pointer immediately after that will crash the system. Found this bug when kernel is built with CONFIG_PAGE_POISONING and testing loading/unloading audio drivers in a loop on Qcom platforms. Fix this by moving of_node_clear_flag() just before the unregister calls. Below is the crash trace: Unable to handle kernel paging request at virtual address 6b6b6b6b6b6c03 Mem abort info: ESR = 0x96000021 Exception class = DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000021 CM = 0, WnR = 0 [006b6b6b6b6b6c03] address between user and kernel address ranges Internal error: Oops: 96000021 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 1784 Comm: sh Tainted: G W 4.17.0-rc7-02230-ge3a63a7ef641-dirty #204 Hardware name: Qualcomm Technologies, Inc. APQ 8016 SBC (DT) pstate: 80000005 (Nzcv daif -PAN -UAO) pc : clear_bit+0x18/0x2c lr : of_platform_device_destroy+0x64/0xb8 sp : ffff00000c9c3930 x29: ffff00000c9c3930 x28: ffff80003d39b200 x27: ffff000008bb1000 x26: 0000000000000040 x25: 0000000000000124 x24: ffff80003a9a3080 x23: 0000000000000060 x22: ffff00000939f518 x21: ffff80003aa79e98 x20: ffff80003aa3dae0 x19: ffff80003aa3c890 x18: ffff800009feb794 x17: 0000000000000000 x16: 0000000000000000 x15: ffff800009feb790 x14: 0000000000000000 x13: ffff80003a058778 x12: ffff80003a058728 x11: ffff80003a058750 x10: 0000000000000000 x9 : 0000000000000006 x8 : ffff80003a825988 x7 : bbbbbbbbbbbbbbbb x6 : 0000000000000001 x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000008 x2 : 0000000000000001 x1 : 6b6b6b6b6b6b6c03 x0 : 0000000000000000 Process sh (pid: 1784, stack limit = 0x (ptrval)) Call trace: clear_bit+0x18/0x2c q6afe_remove+0x20/0x38 apr_device_remove+0x30/0x70 device_release_driver_internal+0x170/0x208 device_release_driver+0x14/0x20 bus_remove_device+0xcc/0x150 device_del+0x10c/0x310 device_unregister+0x1c/0x70 apr_remove_device+0xc/0x18 device_for_each_child+0x50/0x80 apr_remove+0x18/0x20 rpmsg_dev_remove+0x38/0x68 device_release_driver_internal+0x170/0x208 device_release_driver+0x14/0x20 bus_remove_device+0xcc/0x150 device_del+0x10c/0x310 device_unregister+0x1c/0x70 qcom_smd_remove_device+0xc/0x18 device_for_each_child+0x50/0x80 qcom_smd_unregister_edge+0x3c/0x70 smd_subdev_remove+0x18/0x28 rproc_stop+0x48/0xd8 rproc_shutdown+0x60/0xe8 state_store+0xbc/0xf8 dev_attr_store+0x18/0x28 sysfs_kf_write+0x3c/0x50 kernfs_fop_write+0x118/0x1e0 __vfs_write+0x18/0x110 vfs_write+0xa4/0x1a8 ksys_write+0x48/0xb0 sys_write+0xc/0x18 el0_svc_naked+0x30/0x34 Code: d2800022 8b400c21 f9800031 9ac32043 (c85f7c22) ---[ end trace 32020935775616a2 ]--- Signed-off-by: Srinivas Kandagatla --- Changes since v2: Move the calls to of_node_clear_flag just before unregister, suggested by Rob. drivers/of/platform.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.16.2 diff --git a/drivers/of/platform.c b/drivers/of/platform.c index c00d81dfac0b..9c91f97ffbe1 100644 --- a/drivers/of/platform.c +++ b/drivers/of/platform.c @@ -537,6 +537,9 @@ int of_platform_device_destroy(struct device *dev, void *data) if (of_node_check_flag(dev->of_node, OF_POPULATED_BUS)) device_for_each_child(dev, NULL, of_platform_device_destroy); + of_node_clear_flag(dev->of_node, OF_POPULATED); + of_node_clear_flag(dev->of_node, OF_POPULATED_BUS); + if (dev->bus == &platform_bus_type) platform_device_unregister(to_platform_device(dev)); #ifdef CONFIG_ARM_AMBA @@ -544,8 +547,6 @@ int of_platform_device_destroy(struct device *dev, void *data) amba_device_unregister(to_amba_device(dev)); #endif - of_node_clear_flag(dev->of_node, OF_POPULATED); - of_node_clear_flag(dev->of_node, OF_POPULATED_BUS); return 0; } EXPORT_SYMBOL_GPL(of_platform_device_destroy);