From patchwork Fri Nov 7 04:05:49 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: wangyijing X-Patchwork-Id: 40374 Return-Path: X-Original-To: linaro@patches.linaro.org Delivered-To: linaro@patches.linaro.org Received: from mail-wg0-f71.google.com (mail-wg0-f71.google.com [74.125.82.71]) by ip-10-151-82-157.ec2.internal (Postfix) with ESMTPS id 4E0FD24237 for ; Fri, 7 Nov 2014 03:24:39 +0000 (UTC) Received: by mail-wg0-f71.google.com with SMTP id b13sf1362130wgh.6 for ; Thu, 06 Nov 2014 19:24:38 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:delivered-to:from:to:cc:subject:date:message-id :mime-version:sender:precedence:list-id:x-original-sender :x-original-authentication-results:mailing-list:list-post:list-help :list-archive:list-unsubscribe:content-type; bh=Z1re7S4UGat4k+gDq8OGamaLJUIb8LsB62123wIZOBg=; b=VhbGU78ZdkV/RKjzueHPzrWS+sRV+6+JgY56Vo+LkA/ZTW31ls3a6kXwly4KwJpZma ee1LRA8cPhO28sRylHRcPtRymZTLn7BfSDCUSflvTMSDCnPgsWFZYupUfuCUOMptMUT/ bWvxlzyxEBeKjIEtSK0SvXcITfMB4jDDLEe8F13ujnUZfqLAmuhg9B/3xXWu/8pbm7Ks v97aNSQLci/rxgZlNvK0zf81KeGOiizYlURSQ/jORCUwQrtfAoZFrqjZe2p4UHVyI2AZ 2yiGF+8ONCWmjNzc1rKPDHl7831NpwiDdOUPQ2ZBh6CqnYuz27fDqpyGGHnYa8yHKx7g aq2A== X-Gm-Message-State: ALoCoQkwXSwQv8bO3lmxj7XxStDV9DFR3vt3ion7kR2CDzsEpZ2WIKlB7aaYKJGZrf/0y0fRa4XP X-Received: by 10.181.11.193 with SMTP id ek1mr285255wid.0.1415330678400; Thu, 06 Nov 2014 19:24:38 -0800 (PST) X-BeenThere: patchwork-forward@linaro.org Received: by 10.152.28.4 with SMTP id x4ls163709lag.42.gmail; Thu, 06 Nov 2014 19:24:37 -0800 (PST) X-Received: by 10.152.19.37 with SMTP id b5mr318354lae.80.1415330677920; Thu, 06 Nov 2014 19:24:37 -0800 (PST) Received: from mail-la0-f49.google.com (mail-la0-f49.google.com. [209.85.215.49]) by mx.google.com with ESMTPS id la7si13389703lab.98.2014.11.06.19.24.37 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Thu, 06 Nov 2014 19:24:37 -0800 (PST) Received-SPF: pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.215.49 as permitted sender) client-ip=209.85.215.49; Received: by mail-la0-f49.google.com with SMTP id ge10so3765094lab.36 for ; Thu, 06 Nov 2014 19:24:37 -0800 (PST) X-Received: by 10.112.45.228 with SMTP id q4mr8693314lbm.35.1415330677527; Thu, 06 Nov 2014 19:24:37 -0800 (PST) X-Forwarded-To: patchwork-forward@linaro.org X-Forwarded-For: patch@linaro.org patchwork-forward@linaro.org Delivered-To: patch@linaro.org Received: by 10.112.184.201 with SMTP id ew9csp141817lbc; Thu, 6 Nov 2014 19:24:36 -0800 (PST) X-Received: by 10.68.237.161 with SMTP id vd1mr9275639pbc.26.1415330675971; Thu, 06 Nov 2014 19:24:35 -0800 (PST) Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id a10si7743285pat.135.2014.11.06.19.24.35 for ; Thu, 06 Nov 2014 19:24:35 -0800 (PST) Received-SPF: none (google.com: stable-owner@vger.kernel.org does not designate permitted sender hosts) client-ip=209.132.180.67; Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751225AbaKGDY2 (ORCPT + 1 other); Thu, 6 Nov 2014 22:24:28 -0500 Received: from szxga01-in.huawei.com ([119.145.14.64]:15994 "EHLO szxga01-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751051AbaKGDY1 (ORCPT ); Thu, 6 Nov 2014 22:24:27 -0500 Received: from 172.24.2.119 (EHLO SZXEML455-HUB.china.huawei.com) ([172.24.2.119]) by szxrg01-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id CEB33902; Fri, 07 Nov 2014 11:24:23 +0800 (CST) Received: from localhost.localdomain (10.175.100.166) by SZXEML455-HUB.china.huawei.com (10.82.67.198) with Microsoft SMTP Server id 14.3.158.1; Fri, 7 Nov 2014 11:24:15 +0800 From: Yijing Wang To: CC: , , , Yijing Wang , Weng Meiling , Subject: [PATCH] sysfs: driver core: Fix glue dir race condition by gdp_mutex Date: Fri, 7 Nov 2014 12:05:49 +0800 Message-ID: <1415333149-13099-1-git-send-email-wangyijing@huawei.com> X-Mailer: git-send-email 1.7.1 MIME-Version: 1.0 X-Originating-IP: [10.175.100.166] X-CFilter-Loop: Reflected Sender: stable-owner@vger.kernel.org Precedence: list List-ID: X-Mailing-List: stable@vger.kernel.org X-Removed-Original-Auth: Dkim didn't pass. X-Original-Sender: wangyijing@huawei.com X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.215.49 as permitted sender) smtp.mail=patch+caf_=patchwork-forward=linaro.org@linaro.org Mailing-list: list patchwork-forward@linaro.org; contact patchwork-forward+owners@linaro.org X-Google-Group-Id: 836684582541 List-Post: , List-Help: , List-Archive: List-Unsubscribe: , There is a race condition when removing glue directory. It can be reproduced in following test: path 1: Add first child device device_add() get_device_parent() /*find parent from glue_dirs.list*/ list_for_each_entry(k, &dev->class->p->glue_dirs.list, entry) if (k->parent == parent_kobj) { kobj = kobject_get(k); break; } .... class_dir_create_and_add() path2: Remove last child device under glue dir device_del() cleanup_device_parent() cleanup_glue_dir() kobject_put(glue_dir); If path2 has been called cleanup_glue_dir(), but not call kobject_put(glue_dir), the glue dir is still in parent's kset list. Meanwhile, path1 find the glue dir from the glue_dirs.list. Path2 may release glue dir before path1 call kobject_get(). So kernel will report the warning and bug_on. This is a "classic" problem we have of a kref in a list that can be found while the last instance could be removed at the same time. This patch reuse gdp_mutex to fix this race condition. The following calltrace is captured in kernel 3.4, but the latest kernel still has this bug. ----------------------------------------------------- <4>[ 3965.441471] WARNING: at ...include/linux/kref.h:41 kobject_get+0x33/0x40() <4>[ 3965.441474] Hardware name: Romley <4>[ 3965.441475] Modules linked in: isd_iop(O) isd_xda(O)... ... <4>[ 3965.441605] Call Trace: <4>[ 3965.441611] [] warn_slowpath_common+0x7a/0xb0 <4>[ 3965.441615] [] warn_slowpath_null+0x15/0x20 <4>[ 3965.441618] [] kobject_get+0x33/0x40 <4>[ 3965.441624] [] get_device_parent.isra.11+0x135/0x1f0 <4>[ 3965.441627] [] device_add+0xd4/0x6d0 <4>[ 3965.441631] [] ? dev_set_name+0x3c/0x40 .... <2>[ 3965.441912] kernel BUG at ..../fs/sysfs/group.c:65! <4>[ 3965.441915] invalid opcode: 0000 [#1] SMP ... <4>[ 3965.686743] [] sysfs_create_group+0xe/0x10 <4>[ 3965.686748] [] blk_trace_init_sysfs+0x14/0x20 <4>[ 3965.686753] [] blk_register_queue+0x3b/0x120 <4>[ 3965.686756] [] add_disk+0x1cc/0x490 .... ------------------------------------------------------- Signed-off-by: Yijing Wang Signed-off-by: Weng Meiling Cc: #3.4+ --- drivers/base/core.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/drivers/base/core.c b/drivers/base/core.c index 14d1629..842d047 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c @@ -724,12 +724,12 @@ class_dir_create_and_add(struct class *class, struct kobject *parent_kobj) return &dir->kobj; } +static DEFINE_MUTEX(gdp_mutex); static struct kobject *get_device_parent(struct device *dev, struct device *parent) { if (dev->class) { - static DEFINE_MUTEX(gdp_mutex); struct kobject *kobj = NULL; struct kobject *parent_kobj; struct kobject *k; @@ -793,7 +793,9 @@ static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir) glue_dir->kset != &dev->class->p->glue_dirs) return; + mutex_lock(&gdp_mutex); kobject_put(glue_dir); + mutex_unlock(&gdp_mutex); } static void cleanup_device_parent(struct device *dev)