Messages in this thread | | | Date | Mon, 3 Sep 2012 23:18:47 +0300 | From | "Michael S. Tsirkin" <> | Subject | Re: [PATCH] virtio: Don't access device data after unregistration. |
| |
On Mon, Sep 03, 2012 at 04:50:10PM +0200, Sjur Brændeland wrote: > Hi Michael, > > >> Fix panic in virtio.c when CONFIG_DEBUG_SLAB is set. > > > > What's the root cause of the panic? > > I believe the cause of the panic is calling > ida_simple_remove(&virtio_index_ida, dev->index); > when the dev structure is "poisoned" after kfree. > It might be the "BUG_ON((int)id < 0)" that bites... > > >> Use device_del() and put_device() instead of > >> device_unregister(), and access device data before > >> calling put_device(). > > > Why does this help? Does device_unregister free the > > device so dev->index access crashes? > > Yes, if device ref-count is one when calling unregister > the device is freed.
Interesting. Where exactly? Note that:
struct rproc_vdev { struct list_head node; struct rproc *rproc; struct virtio_device vdev; struct rproc_vring vring[RVDEV_NUM_VRINGS]; unsigned long dfeatures; unsigned long gfeatures; };
kfree(&proc_vdev->vdev) is unlikely to be the right thing to do.
> > If yes virtio_pci_remove will crash too > > as it accesses the device after the > > call to unregister_virtio_device so the > > fix won't be effective. > > I discovered this using the remoteproc framework. > It might be that device is unregistered with ref-count greater > than one normally, in that case this bug will not show up. > > Regards, > Sjur
It might be remoteproc has an unrelated bug?
-- MST -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |