Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eaecc204 authored by Ming Lei's avatar Ming Lei Committed by Lingutla Chandrasekhar
Browse files

driver core: fix race between creating/querying glue dir and its cleanup 



The global mutex of 'gdp_mutex' is used to serialize creating/querying
glue dir and its cleanup. Turns out it isn't a perfect way because
part(kobj_kset_leave()) of the actual cleanup action() is done inside
the release handler of the glue dir kobject. That means gdp_mutex has
to be held before releasing the last reference count of the glue dir
kobject.

This patch moves glue dir's cleanup after kobject_del() in device_del()
for avoiding the race.

Change-Id: Ie43f889499546338d37cfbdd0dd8967ad18b8234
Cc: Yijing Wang <wangyijing@huawei.com>
Reported-by: default avatarChandra Sekhar Lingutla <clingutla@codeaurora.org>
Signed-off-by: default avatarMing Lei <ming.lei@canonical.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: cebf8fd16900fdfd58c0028617944f808f97fe50
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git


[clingutla@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: default avatarLingutla Chandrasekhar <clingutla@codeaurora.org>
parent 9609992d

drivers/base/core.c

+29 −10
Original line number Diff line number Diff line
@@ -786,11 +786,29 @@ static struct kobject *get_device_parent(struct device *dev, 
	return NULL;

}



static inline bool live_in_glue_dir(struct kobject *kobj,

				    struct device *dev)

{

	if (!kobj || !dev->class ||

	    kobj->kset != &dev->class->p->glue_dirs)

		return false;

	return true;

}



static inline struct kobject *get_glue_dir(struct device *dev)

{

	return dev->kobj.parent;

}



/*

 * make sure cleaning up dir as the last step, we need to make

 * sure .release handler of kobject is run with holding the

 * global lock

 */

static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir)

{

	/* see if we live in a "glue" directory */

	if (!glue_dir || !dev->class ||

	    glue_dir->kset != &dev->class->p->glue_dirs)

	if (!live_in_glue_dir(glue_dir, dev))

		return;



	mutex_lock(&gdp_mutex);
@@ -798,11 +816,6 @@ static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir) 
	mutex_unlock(&gdp_mutex);

}



static void cleanup_device_parent(struct device *dev)

{

	cleanup_glue_dir(dev, dev->kobj.parent);

}



static int device_add_class_symlinks(struct device *dev)

{

	int error;
@@ -966,6 +979,7 @@ int device_add(struct device *dev) 
	struct kobject *kobj;

	struct class_interface *class_intf;

	int error = -EINVAL;

	struct kobject *glue_dir = NULL;



	dev = get_device(dev);

	if (!dev)
@@ -1010,8 +1024,10 @@ int device_add(struct device *dev) 
	/* first, register with generic layer. */

	/* we require the name to be set before, and pass NULL */

	error = kobject_add(&dev->kobj, dev->kobj.parent, NULL);

	if (error)

	if (error) {

		glue_dir = get_glue_dir(dev);

		goto Error;

	}



	/* notify platform of device entry */

	if (platform_notify)
@@ -1100,9 +1116,10 @@ done: 
	device_remove_file(dev, &dev_attr_uevent);

 attrError:

	kobject_uevent(&dev->kobj, KOBJ_REMOVE);

	glue_dir = get_glue_dir(dev);

	kobject_del(&dev->kobj);

 Error:

	cleanup_device_parent(dev);

	cleanup_glue_dir(dev, glue_dir);

	if (parent)

		put_device(parent);

name_error:
@@ -1179,6 +1196,7 @@ EXPORT_SYMBOL_GPL(put_device); 
void device_del(struct device *dev)

{

	struct device *parent = dev->parent;

	struct kobject *glue_dir = NULL;

	struct class_interface *class_intf;



	/* Notify clients of device removal.  This call must come
@@ -1223,8 +1241,9 @@ void device_del(struct device *dev) 
		blocking_notifier_call_chain(&dev->bus->p->bus_notifier,

					     BUS_NOTIFY_REMOVED_DEVICE, dev);

	kobject_uevent(&dev->kobj, KOBJ_REMOVE);

	cleanup_device_parent(dev);

	glue_dir = get_glue_dir(dev);

	kobject_del(&dev->kobj);

	cleanup_glue_dir(dev, glue_dir);

	put_device(parent);

}

EXPORT_SYMBOL_GPL(device_del);