lkml.org 
[lkml]   [2017]   [Jul]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.12 010/196] NFC: fix broken device allocation
    Date
    4.12-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Johan Hovold <johan@kernel.org>

    commit 20777bc57c346b6994f465e0d8261a7fbf213a09 upstream.

    Commit 7eda8b8e9677 ("NFC: Use IDR library to assing NFC devices IDs")
    moved device-id allocation and struct-device initialisation from
    nfc_allocate_device() to nfc_register_device().

    This broke just about every nfc-device-registration error path, which
    continue to call nfc_free_device() that tries to put the device
    reference of the now uninitialised (but zeroed) struct device:

    kobject: '(null)' (ce316420): is not initialized, yet kobject_put() is being called.

    The late struct-device initialisation also meant that various work
    queues whose names are derived from the nfc device name were also
    misnamed:

    421 root 0 SW< [(null)_nci_cmd_]
    422 root 0 SW< [(null)_nci_rx_w]
    423 root 0 SW< [(null)_nci_tx_w]

    Move the id-allocation and struct-device initialisation back to
    nfc_allocate_device() and fix up the single call site which did not use
    nfc_free_device() in its error path.

    Fixes: 7eda8b8e9677 ("NFC: Use IDR library to assing NFC devices IDs")
    Cc: Samuel Ortiz <sameo@linux.intel.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/nfc/core.c | 31 ++++++++++++++++++-------------
    net/nfc/nci/core.c | 3 +--
    2 files changed, 19 insertions(+), 15 deletions(-)

    --- a/net/nfc/core.c
    +++ b/net/nfc/core.c
    @@ -982,6 +982,8 @@ static void nfc_release(struct device *d
    kfree(se);
    }

    + ida_simple_remove(&nfc_index_ida, dev->idx);
    +
    kfree(dev);
    }

    @@ -1056,6 +1058,7 @@ struct nfc_dev *nfc_allocate_device(stru
    int tx_headroom, int tx_tailroom)
    {
    struct nfc_dev *dev;
    + int rc;

    if (!ops->start_poll || !ops->stop_poll || !ops->activate_target ||
    !ops->deactivate_target || !ops->im_transceive)
    @@ -1068,6 +1071,15 @@ struct nfc_dev *nfc_allocate_device(stru
    if (!dev)
    return NULL;

    + rc = ida_simple_get(&nfc_index_ida, 0, 0, GFP_KERNEL);
    + if (rc < 0)
    + goto err_free_dev;
    + dev->idx = rc;
    +
    + dev->dev.class = &nfc_class;
    + dev_set_name(&dev->dev, "nfc%d", dev->idx);
    + device_initialize(&dev->dev);
    +
    dev->ops = ops;
    dev->supported_protocols = supported_protocols;
    dev->tx_headroom = tx_headroom;
    @@ -1090,6 +1102,11 @@ struct nfc_dev *nfc_allocate_device(stru
    }

    return dev;
    +
    +err_free_dev:
    + kfree(dev);
    +
    + return ERR_PTR(rc);
    }
    EXPORT_SYMBOL(nfc_allocate_device);

    @@ -1104,14 +1121,6 @@ int nfc_register_device(struct nfc_dev *

    pr_debug("dev_name=%s\n", dev_name(&dev->dev));

    - dev->idx = ida_simple_get(&nfc_index_ida, 0, 0, GFP_KERNEL);
    - if (dev->idx < 0)
    - return dev->idx;
    -
    - dev->dev.class = &nfc_class;
    - dev_set_name(&dev->dev, "nfc%d", dev->idx);
    - device_initialize(&dev->dev);
    -
    mutex_lock(&nfc_devlist_mutex);
    nfc_devlist_generation++;
    rc = device_add(&dev->dev);
    @@ -1149,12 +1158,10 @@ EXPORT_SYMBOL(nfc_register_device);
    */
    void nfc_unregister_device(struct nfc_dev *dev)
    {
    - int rc, id;
    + int rc;

    pr_debug("dev_name=%s\n", dev_name(&dev->dev));

    - id = dev->idx;
    -
    if (dev->rfkill) {
    rfkill_unregister(dev->rfkill);
    rfkill_destroy(dev->rfkill);
    @@ -1179,8 +1186,6 @@ void nfc_unregister_device(struct nfc_de
    nfc_devlist_generation++;
    device_del(&dev->dev);
    mutex_unlock(&nfc_devlist_mutex);
    -
    - ida_simple_remove(&nfc_index_ida, id);
    }
    EXPORT_SYMBOL(nfc_unregister_device);

    --- a/net/nfc/nci/core.c
    +++ b/net/nfc/nci/core.c
    @@ -1173,8 +1173,7 @@ struct nci_dev *nci_allocate_device(stru
    return ndev;

    free_nfc:
    - kfree(ndev->nfc_dev);
    -
    + nfc_free_device(ndev->nfc_dev);
    free_nci:
    kfree(ndev);
    return NULL;

    \
     
     \ /
      Last update: 2017-07-25 21:24    [W:2.821 / U:1.788 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site