lkml.org 
[lkml]   [2005]   [May]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectPossible bug in device_find() or in bus_add_device()
Date
[2Alexander: the memory breakage I mentioned looks to be actually not a 
memory breakage, but a bug in linux device model code. So I'm reporting it
to kernel mailing list]

Hello.

While developing a driver for an embedded system, I am getting crashes in
calls to device_find().

I tried to find out what is going on, and found the following.

Device seems to be added it's bus'es device list in bus_add_device() by the
following statement:

list_add_tail(&dev->bus_list, &dev->bus->devices.list);

So struct device object gets linked to bus->devices.list using it's
bus_list field.
However, device_find() calls kset_find_obj(&bus->devices, name), which in
turn dereferences bus->devices in the following statement:

list_for_each(entry,&kset->list) {
struct kobject * k = to_kobj(entry);
...

where kset->list is the above bus->devices.list, and to_kobj is defined as
container_of(entry,struct kobject,entry)
So it assumes that objects are linked to bus->devices.list using
kobject::entry field. But actually struct device objects are linked to
bus->devices.list using their bus_list field, not kobj.entry field!
So code in kset_find_obj() gets an invalid pointer to kobj, which leads to
a crash.

Looks like a bug.

The above code snippets all exist in (currently latest) 2.6.12-pre4 kernel
tree from kernel.org.

I'm not familiar with linux device model. Could someone please help to find
the best way to fix this (other than not using device_find() at all)?

Nikita Youshchenko

P.S.
Please CC replies to my e-mail address, yoush@cs.msu.su
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2005-05-23 23:14    [W:0.044 / U:0.336 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site