From: Andy Shevchenko <andy.shevchenko@gmail.com>
To: Kent Gibson <warthog618@gmail.com>
Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
"Rafael J. Wysocki" <rafael@kernel.org>,
ACPI Devel Maling List <linux-acpi@vger.kernel.org>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Bartosz Golaszewski <brgl@bgdev.pl>
Subject: Re: linux 5.15-rc4: refcount underflow when unloading gpio-mockup
Date: Tue, 5 Oct 2021 11:21:53 +0300 [thread overview]
Message-ID: <YVwLIWrqY9TRLjwG@smile.fi.intel.com> (raw)
In-Reply-To: <20211005004035.GA29779@sol>
On Tue, Oct 05, 2021 at 08:40:35AM +0800, Kent Gibson wrote:
> On Mon, Oct 04, 2021 at 10:56:00PM +0300, Andy Shevchenko wrote:
> > On Mon, Oct 4, 2021 at 8:51 PM Kent Gibson <warthog618@gmail.com> wrote:
...
> > Here is debug prints of what happens
> >
> > # modprobe gpio-mockup gpio_mockup_ranges=-1,10
> > [ 212.850993] (null): device_create_managed_software_node <<< 0
> > [ 212.858177] platform gpio-mockup.0: software_node_notify 0 <<<
> > [ 212.865264] platform gpio-mockup.0: software_node_notify 1 <<< 1
> > [ 212.874159] gpio-mockup gpio-mockup.0: no of_node; not parsing pinctrl DT
> > [ 212.882962] gpiochip_find_base: found new base at 840
> > [ 212.889873] gpio gpiochip3: software_node_notify 0 <<<
> > [ 212.896164] gpio gpiochip3: software_node_notify 1 <<< 1
> > [ 212.905099] gpio gpiochip3: (gpio-mockup-A): added GPIO chardev (254:3)
> > [ 212.913313] gpio gpiochip840: software_node_notify 0 <<<
> > [ 212.920676] gpio gpiochip3: registered GPIOs 840 to 849 on gpio-mockup-A
> > [ 212.935601] modprobe (185) used greatest stack depth: 12744 bytes left
> >
> > As I read it the software node is created for gpio-mockup device and
> > then _shared_ with the GPIO device, since it's managed it's gone when
> > GPIO device gone followed by UAF when mockup (platform) device itself
> > gone. I.o.w. this software node mustn't be managed because it covers
> > the lifetime of two different objects. The correct fix is to create
> > manually software node and assign it to the pdev and manually free in
> > gpio_mockup_unregister_pdevs()/
> >
> > Tl;DR: it's a bug in gpio-mockup.
>
> So the bug is in the behaviour of gpio_mockup_register_chip()?
Not really. The utter root cause is the former API (device_add_properties()
et al) which Heikki is getting rid of in particular because of this issue,
i.e. when users blindly call it without fully understanding the picture of
the object lifetimes.
> That is out of my court, so I'll leave it to you and Bart to sort out.
I'll see what I can do about.
--
With Best Regards,
Andy Shevchenko
next prev parent reply other threads:[~2021-10-05 8:22 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-04 9:34 Kent Gibson
2021-10-04 9:44 ` Greg Kroah-Hartman
2021-10-04 9:58 ` Kent Gibson
2021-10-04 12:19 ` Kent Gibson
2021-10-04 12:30 ` Heikki Krogerus
2021-10-04 12:47 ` Kent Gibson
2021-10-04 13:20 ` Heikki Krogerus
2021-10-04 14:17 ` Kent Gibson
2021-10-04 15:28 ` Kent Gibson
2021-10-04 19:56 ` Andy Shevchenko
2021-10-05 0:40 ` Kent Gibson
2021-10-05 8:21 ` Andy Shevchenko [this message]
2021-10-05 9:50 ` Heikki Krogerus
2021-10-05 9:53 ` Andy Shevchenko
2021-10-05 9:57 ` Heikki Krogerus
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YVwLIWrqY9TRLjwG@smile.fi.intel.com \
--to=andy.shevchenko@gmail.com \
--cc=brgl@bgdev.pl \
--cc=gregkh@linuxfoundation.org \
--cc=heikki.krogerus@linux.intel.com \
--cc=linux-acpi@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=rafael@kernel.org \
--cc=warthog618@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome