[PATCH] driver core: fix device_create() error path

[PATCH] driver core: fix device_create() error path

[David Herrmann]

We call put_device() in the error path, which is fine for dev==NULL.
However, in case kobject_set_name_vargs() fails, we have dev!=NULL but
device_initialized() wasn't called, yet.

Fix this by splitting device_register() into explicit calls to
device_add() and an early call to device_initialize().

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
---
 drivers/base/core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/base/core.c b/drivers/base/core.c
index 34abf4d..4be8911 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -1676,6 +1676,7 @@ device_create_groups_vargs(struct class *class, struct device *parent,
 		goto error;
 	}
 
+	device_initialize(dev);
 	dev->devt = devt;
 	dev->class = class;
 	dev->parent = parent;
@@ -1687,7 +1688,7 @@ device_create_groups_vargs(struct class *class, struct device *parent,
 	if (retval)
 		goto error;
 
-	retval = device_register(dev);
+	retval = device_add(dev);
 	if (retval)
 		goto error;
 
-- 
1.8.4.2

Re: [PATCH] driver core: fix device_create() error path

[David Herrmann]

Hi Greg

Ping?

Thanks
David

On Thu, Nov 21, 2013 at 8:15 PM, David Herrmann <dh.herrmann@gmail.com> wrote:
> We call put_device() in the error path, which is fine for dev==NULL.
> However, in case kobject_set_name_vargs() fails, we have dev!=NULL but
> device_initialized() wasn't called, yet.
>
> Fix this by splitting device_register() into explicit calls to
> device_add() and an early call to device_initialize().
>
> Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
> ---
>  drivers/base/core.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/base/core.c b/drivers/base/core.c
> index 34abf4d..4be8911 100644
> --- a/drivers/base/core.c
> +++ b/drivers/base/core.c
> @@ -1676,6 +1676,7 @@ device_create_groups_vargs(struct class *class, struct device *parent,
>                 goto error;
>         }
>
> +       device_initialize(dev);
>         dev->devt = devt;
>         dev->class = class;
>         dev->parent = parent;
> @@ -1687,7 +1688,7 @@ device_create_groups_vargs(struct class *class, struct device *parent,
>         if (retval)
>                 goto error;
>
> -       retval = device_register(dev);
> +       retval = device_add(dev);
>         if (retval)
>                 goto error;
>
> --
> 1.8.4.2
>

Re: [PATCH] driver core: fix device_create() error path

[Greg Kroah-Hartman]

On Sun, Dec 08, 2013 at 03:42:33PM +0100, David Herrmann wrote:
> Hi Greg
> 
> Ping?

It's in my "todo" queue, don't worry, it's not lost.

> On Thu, Nov 21, 2013 at 8:15 PM, David Herrmann <dh.herrmann@gmail.com> wrote:
> > We call put_device() in the error path, which is fine for dev==NULL.
> > However, in case kobject_set_name_vargs() fails, we have dev!=NULL but
> > device_initialized() wasn't called, yet.

If kobject_set_name_vargs() fails, we have bigger problems than this :)

And I think it's safe for a put_device() on a device that wasn't
initialized(), we just get a warning message if that happens.

Not to say that your patch is wrong, I'll look at it soon, but things
should still recover ok from what I can tell.

Oh, and there's the much-complained about memory leak in
kobject_set_name_vargs() if something goes wrong there as well, I have a
patch sitting in my queue to hopefully fix that up.

thanks,

greg k-h

Re: [PATCH] driver core: fix device_create() error path

[David Herrmann]

Hi Greg

On Sun, Dec 8, 2013 at 4:27 PM, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
> On Sun, Dec 08, 2013 at 03:42:33PM +0100, David Herrmann wrote:
>> Hi Greg
>>
>> Ping?
>
> It's in my "todo" queue, don't worry, it's not lost.
>
>> On Thu, Nov 21, 2013 at 8:15 PM, David Herrmann <dh.herrmann@gmail.com> wrote:
>> > We call put_device() in the error path, which is fine for dev==NULL.
>> > However, in case kobject_set_name_vargs() fails, we have dev!=NULL but
>> > device_initialized() wasn't called, yet.
>
> If kobject_set_name_vargs() fails, we have bigger problems than this :)
>
> And I think it's safe for a put_device() on a device that wasn't
> initialized(), we just get a warning message if that happens.

I think it results in a call to kref_sub(), which will call
atomic_sub_and_test() which will fail as the new value is -1. So the
memory isn't freed.

I was just going through my pending patches to make sure they're not
forgotten. Nothing important, but I saw you already applied it.

Thanks
David

> Not to say that your patch is wrong, I'll look at it soon, but things
> should still recover ok from what I can tell.
>
> Oh, and there's the much-complained about memory leak in
> kobject_set_name_vargs() if something goes wrong there as well, I have a
> patch sitting in my queue to hopefully fix that up.
>
> thanks,
>
> greg k-h