Fwd: [PATCH] fix race condition between device_del and device_add

[EunTaik Lee <eun.taik.lee@samsung.com>]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=utf-8, Size: 2575 bytes --]


There is a possible race condition when a device 
is added while another device with the same parent 
, with ref count of one, is deleted.
 CPU0    CPU1 
device_add()   device_del() 
  get_device_parent()     put_device(parent); 
    kobj = kobject_get(k);     kobject_put() 
          kref_put() 
       refcount=0 
      refcount is 0 
      WARNS it was 0 but 
      return kobj            frees kobj 
uses the freed parent kobj
The race condition exists because kref_put() and the 
release function is not atomic. 
Using kobject_get_unless_zero() instead of
kobject_get() in get_device_parent() will prevent 
this race condition.
Signed-off-by: eun.taik.lee <eun.taik.lee@samsung.com> 
--- 
 drivers/base/core.c     |    2 +- 
 include/linux/kobject.h |    2 ++ 
 lib/kobject.c           |    2 +- 
 3 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/base/core.c b/drivers/base/core.c 
index 07304a3..ec2f211 100644 
--- a/drivers/base/core.c 
+++ b/drivers/base/core.c 
@@ -761,7 +761,7 @@ static struct kobject *get_device_parent(struct device *dev, 
   spin_lock(&dev->class->p->glue_dirs.list_lock); 
   list_for_each_entry(k, &dev->class->p->glue_dirs.list, entry) 
    if (k->parent == parent_kobj) { 
-    kobj = kobject_get(k); 
+    kobj = kobject_get_unless_zero(k); 
     break; 
    } 
   spin_unlock(&dev->class->p->glue_dirs.list_lock); 
diff --git a/include/linux/kobject.h b/include/linux/kobject.h 
index 2d61b90..3032744 100644 
--- a/include/linux/kobject.h 
+++ b/include/linux/kobject.h 
@@ -107,6 +107,8 @@ extern int __must_check kobject_rename(struct kobject *, const char *new_name); 
 extern int __must_check kobject_move(struct kobject *, struct kobject *); 
  
 extern struct kobject *kobject_get(struct kobject *kobj); 
+extern struct kobject * __must_check kobject_get_unless_zero( 
+  struct kobject *kobj); 
 extern void kobject_put(struct kobject *kobj); 
  
 extern const void *kobject_namespace(struct kobject *kobj); 
diff --git a/lib/kobject.c b/lib/kobject.c 
index 03d4ab3..ff0ce681 100644 
--- a/lib/kobject.c 
+++ b/lib/kobject.c 
@@ -581,7 +581,7 @@ struct kobject *kobject_get(struct kobject *kobj) 
  return kobj; 
 } 
  
-static struct kobject * __must_check kobject_get_unless_zero(struct kobject *kobj) 
+struct kobject * __must_check kobject_get_unless_zero(struct kobject *kobj) 
 { 
  if (!kref_get_unless_zero(&kobj->kref)) 
   kobj = NULL;ÿôèº{.nÇ+‰·Ÿ®‰­†+%ŠËÿ±éݶ\x17¥Šwÿº{.nÇ+‰·¥Š{±þG«éÿŠ{ayº\x1dʇڙë,j\a­¢f£¢·hšïêÿ‘êçz_è®\x03(­éšŽŠÝ¢j"ú\x1a¶^[m§ÿÿ¾\a«þG«éÿ¢¸?™¨è­Ú&£ø§~á¶iO•æ¬z·švØ^\x14\x04\x1a¶^[m§ÿÿÃ\fÿ¶ìÿ¢¸?–I¥