From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ej1-f46.google.com (mail-ej1-f46.google.com [209.85.218.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7ABF821420B for ; Fri, 21 Nov 2025 11:38:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763725099; cv=none; b=AN+cZKxJeZkn+ocu4ui+Z3wJHBSLZfMeXCA/kX1B6P4DqF4VUP5Hd89IxxuEt9ZRTkjIj4A47hlXrOzD1rdno8N8Apb+tD3oY9c0Cc3iNv4KKxFz+S4osebEUoepSLyRStWoynfVLHEYm5G7nQcmnmRy8QYt/f/ZwBDyGuZA9/8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763725099; c=relaxed/simple; bh=9KY9kD5likLIMG9QJ3dtMJ1K3TKfOU6DfXvW5s3ZVEg=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=dh9P1hM6D0M99VznzU6PvidxpzgGpgitpiZ1oD+RobXbIi7FE2+MEcS0T7yMLlIXPl4s9x7lPt1j1zRgsxkStRjSvTJ+OnOLt1ktDaqHOATwlzQXa5LePrjKnWmFE3/lv1PFa3tyFgZ0EGsfUpzV8t6d/GsyiTszyv9LLxb6iO8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=suse.com; spf=pass smtp.mailfrom=suse.com; dkim=pass (2048-bit key) header.d=suse.com header.i=@suse.com header.b=etlPLNPM; arc=none smtp.client-ip=209.85.218.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=suse.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=suse.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=suse.com header.i=@suse.com header.b="etlPLNPM" Received: by mail-ej1-f46.google.com with SMTP id a640c23a62f3a-b728a43e410so341080666b.1 for ; Fri, 21 Nov 2025 03:38:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=google; t=1763725094; x=1764329894; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=elqtsntuivpHCkJpreZ6fcI0MQ78Y6tLnQPo2Lde0c4=; b=etlPLNPM75fr5fMFgjSJ2QvrA6WsN0W1vN7XNtQRUHoIV4XL7Bv0fKrJUV88kR9EDg BGeqoChshNunxgxuUlvdPidPA/dkAAfYYvHvs1T8+/rCcIy4+KIMqKx1Yxgd0zHi5KyO CtrySEzVPsHkKjtjXXMB7rvcY3n8VBIpe9AfaTECM6uW4nVDaz890lDWbCRbG6xEhSss JF5ojkIjUNHdjgVHh/KDFi6zHPbShWxCmiHz431qTofV97g1xkSvplo0RCf2WEshpUfG SRZK0l53xUFqUJYLxNnYONNia/T1tgmb+b3l5t+weS7GI4lwzXYY08Z6xwHI7PJoAFu4 CKvQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763725094; x=1764329894; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=elqtsntuivpHCkJpreZ6fcI0MQ78Y6tLnQPo2Lde0c4=; b=XFtZXpItFxMdfn0O6UfQbBsD9AGrSklKg8oKTlbq3DJcmQ0aa7uV1AVswvDj4WuzfM Srw0hqrAOOC3j4yrCpMpWTisbJYn6HYSK7+wlvBa9jIAqWLS6lejyx9BrXhYnDYk+F/a 6zzRJCH3IM3oe6c+bgi3q7F0v0xQ1ITLf8OjH4JgFADB4gcD3/PUD1Imk0YXwfqk89PH /DHBMoo7R7b4TtZHhcvEp/tBN5VHKlJQkJjjGWNtSJFLn/58wRUMgRo2s4P7/WGOjFg8 MvZ/SLk3HtzwpPGmQ6vsiQ+X3DUBqJNolCAFft3tssyaYVvPglY3mIjZXq1f6mkhgmCx evfA== X-Gm-Message-State: AOJu0YwioLKuUfK5PooI8W2D4k/BQLj95TqQmaI25J9kkaHXh1mifIx2 aQ97x82Ro+/RpS/KOXEK9c2LMDYyRUvltBwLHyotfbz+eC11Jl4ikx9LGdPetFcTIt0= X-Gm-Gg: ASbGncuoHw11PmqCCADk+i1zVut/4DkNKWo3Bxkeo+aPbV0ZNOjdedP2J+o3TnZDBbr +SPZRVAXl7ZdiBY7PDhGfmrtgQhQorfybP/aXHLnmMt8n026Hle/LXmNbAHnJ1E/+mxzKNOInVv 8t23I6XhfBbjuD47jf5sQr+qAvrxpPgkn1jt1z0lQWDNcjqEFerbOurJIu4D6JSwlcwM/yZZd+a O1zHjr0B3A1feSlMY46sYuNcQomoRJj9fo7iofRQyJ4BYZxgcoANgQy5v2t8FIvmEdNPJlUai+f EkIyL2AjDfdVGOya5hqcNJIFMvt0LDxJBQZIhCmQit4AdoOHJgZudMr+6F6x84S8Jz5X86lzMIq Fkfr8tokzNGpULnCHPBpIpfdUW2i7YSydzHdGCkUAXQjJNCEWsDC4I0pyXCsKrjAJ1YzTefan25 QZelsG2xcqUIdzpA== X-Google-Smtp-Source: AGHT+IGPCTk0a4A9CAbTPZvb15hu5OaSysb+kkueXj8zPNTrbGoOpFr8hTxpFYlmYqiMPRIXIcBZMA== X-Received: by 2002:a17:907:72c8:b0:b73:1baa:6424 with SMTP id a640c23a62f3a-b767189b474mr208928966b.55.1763725094303; Fri, 21 Nov 2025 03:38:14 -0800 (PST) Received: from pathway.suse.cz ([176.114.240.130]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-b7654d54cf2sm439059266b.18.2025.11.21.03.38.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 21 Nov 2025 03:38:13 -0800 (PST) Date: Fri, 21 Nov 2025 12:38:12 +0100 From: Petr Mladek To: Chris Down Cc: linux-kernel@vger.kernel.org, Greg Kroah-Hartman , Sergey Senozhatsky , Steven Rostedt , John Ogness , Geert Uytterhoeven , Tony Lindgren , kernel-team@fb.com Subject: Re: [PATCH v7 07/13] printk: console: Introduce sysfs interface for per-console loglevels Message-ID: References: <464d918b5497f6c7463b96b8241a65a575d932e0.1763492585.git.chris@chrisdown.name> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <464d918b5497f6c7463b96b8241a65a575d932e0.1763492585.git.chris@chrisdown.name> On Wed 2025-11-19 03:07:27, Chris Down wrote: > A sysfs interface under /sys/class/console/ is created that permits > viewing and configuring per-console attributes. This is the main > interface with which we expect users to interact with and configure > per-console loglevels. I made the following test: 1. Enable some debugging (CONFIG_DEBUG_KOBJECT=y, CONFIG_DEBUG_DRIVER=y) 2. Compile ttynull driver as a module (CONFIG_NULL_TTY=m) 3. Add "console=null" on the command line 4. Load the module "modprobe ttynull" 5. Remove the module "rmmod ttynull" And I got the following warning when the module was removed: [ 382.299081] printk: legacy console [ttynull0] disabled [ 382.301829] device: 'ttynull0': device_unregister [ 382.302057] kobject: 'ttynull0' (000000006a6b229d): kobject_uevent_env [ 382.302088] kobject: 'ttynull0' (000000006a6b229d): fill_kobj_path: path = '/devices/virtual/console/ttynull0' [ 382.302250] kobject: 'ttynull0' (000000006a6b229d): kobject_cleanup, parent 0000000000000000 [ 382.302261] kobject: 'ttynull0' (000000006a6b229d): calling ktype release [ 382.302272] kobject: 'ttynull0': free name [ 382.302281] ------------[ cut here ]------------ [ 382.302289] refcount_t: underflow; use-after-free. [ 382.302319] WARNING: CPU: 4 PID: 1857 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110 [ 382.302335] Modules linked in: ttynull(E-) [ 382.302366] CPU: 4 UID: 0 PID: 1857 Comm: rmmod Tainted: G E 6.18.0-rc6-default+ #448 PREEMPT(full) b65a5eeebb0a78c479429a4b06dbf6320bbcd33d [ 382.302379] Tainted: [E]=UNSIGNED_MODULE [ 382.302388] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014 [ 382.302396] RIP: 0010:refcount_warn_saturate+0xbe/0x110 [ 382.302407] Code: 01 01 e8 05 11 60 ff 0f 0b e9 29 2f 3b ff 80 3d cb 17 b0 01 00 75 85 48 c7 c7 28 d8 00 9d c6 05 bb 17 b0 01 01 e8 e2 10 60 ff <0f> 0b e9 06 2f 3b ff 80 3d a9 17 b0 01 00 0f 85 5e ff ff ff 48 c7 [ 382.302417] RSP: 0018:ffffcbd70189fe60 EFLAGS: 00010282 [ 382.302433] RAX: 0000000000000000 RBX: ffffffffc0459040 RCX: 0000000000000002 [ 382.302441] RDX: ffff8b32f57dff48 RSI: 0000000000000001 RDI: 00000000ffffffff [ 382.302450] RBP: ffff8b328b4f7000 R08: 00000000fff7ffff R09: ffff8b32fe3fdfa8 [ 382.302458] R10: 0000000000000004 R11: 00000000fff80000 R12: ffffcbd70189ff58 [ 382.302467] R13: 00000000000000b0 R14: 0000000000000000 R15: 0000000000000000 [ 382.302479] FS: 00007f2e97442740(0000) GS:ffff8b3357178000(0000) knlGS:0000000000000000 [ 382.302488] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 382.302497] CR2: 00007fa3088176f8 CR3: 0000000105373000 CR4: 0000000000750ef0 [ 382.302524] PKRU: 55555554 [ 382.302532] Call Trace: [ 382.302542] [ 382.302551] unregister_console_locked.cold+0x28e/0x2cd [ 382.302582] unregister_console+0x1f/0x40 [ 382.302599] ttynull_exit+0x10/0xed0 [ttynull 4b641f8e4981ec0e180c1229c097d2bddb0fbe2a] [ 382.302613] __do_sys_delete_module.isra.0+0x19b/0x270 [ 382.302648] ? srso_alias_return_thunk+0x5/0xfbef5 [ 382.302665] do_syscall_64+0x7a/0x360 [ 382.302692] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 382.302703] RIP: 0033:0x7f2e95d18437 [ 382.302715] Code: 73 01 c3 48 8b 0d 59 0a 2d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 29 0a 2d 00 f7 d8 64 89 01 48 [ 382.302725] RSP: 002b:00007fff591d8468 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 [ 382.302740] RAX: ffffffffffffffda RBX: 00007fff591d84c8 RCX: 00007f2e95d18437 [ 382.302748] RDX: 000000000000000a RSI: 0000000000000800 RDI: 000055fe1453b5e8 [ 382.302757] RBP: 000055fe1453b580 R08: 00007fff591d73e1 R09: 0000000000000000 [ 382.302765] R10: 00007f2e95d9d660 R11: 0000000000000206 R12: 00007fff591d86a0 [ 382.302774] R13: 00007fff591da738 R14: 000055fe1453a3c0 R15: 000055fe1453b580 [ 382.302834] [ 382.302843] irq event stamp: 2523 [ 382.302851] hardirqs last enabled at (2529): [] __up_console_sem+0x5e/0x70 [ 382.302863] hardirqs last disabled at (2534): [] __up_console_sem+0x43/0x70 [ 382.302873] softirqs last enabled at (1622): [] handle_softirqs+0x32c/0x400 [ 382.302885] softirqs last disabled at (1617): [] __irq_exit_rcu+0xd9/0x150 [ 382.302896] ---[ end trace 0000000000000000 ]--- [ 382.303050] device: 'ttynull': device_unregister [ 382.303445] PM: Removing info for No Bus:ttynull [ 382.303454] kobject: 'ttynull' (0000000012b1dfce): kobject_uevent_env [ 382.303459] kobject: 'ttynull' (0000000012b1dfce): fill_kobj_path: path = '/devices/virtual/tty/ttynull' [ 382.303494] kobject: 'ttynull' (0000000012b1dfce): kobject_cleanup, parent 0000000000000000 [ 382.303498] kobject: 'ttynull' (0000000012b1dfce): calling ktype release [ 382.303502] kobject: 'ttynull': free name [ 382.303506] kobject: '(null)' (00000000eec627ea): kobject_cleanup, parent 0000000000000000 [ 382.303516] kobject: '(null)' (00000000eec627ea): calling ktype release [ 382.325859] kobject: 'holders' (0000000087b71c70): kobject_cleanup, parent 0000000040844ced [ 382.325880] kobject: 'holders' (0000000087b71c70): auto cleanup kobject_del [ 382.325918] kobject: 'holders' (0000000087b71c70): calling ktype release [ 382.325931] kobject: (0000000087b71c70): dynamic_kobj_release [ 382.325943] kobject: 'holders': free name [ 382.326895] kobject: 'ttynull' (0000000040844ced): kobject_cleanup, parent 00000000546c84c0 [ 382.326915] kobject: 'ttynull' (0000000040844ced): auto cleanup kobject_del [ 382.326928] kobject: 'ttynull' (0000000040844ced): auto cleanup 'remove' event [ 382.326941] kobject: 'ttynull' (0000000040844ced): kobject_uevent_env [ 382.326959] kobject: 'ttynull' (0000000040844ced): fill_kobj_path: path = '/module/ttynull' [ 382.327049] kobject: 'ttynull' (0000000040844ced): calling ktype release [ 382.327148] kobject: 'ttynull': free name > The lifecycle of this classdev looks like this on registration: > > register_console(con)/printk_late_init() > console_register_device(con) > device_initialize(con->classdev) # kref_init: refcount = 1 > device_add(con->classdev) # get_device: refcount++ (to 2) I think that the problem is here. It is true that device_add() gets extra refcount at the beginning but it is decremented on success, see: int device_add(struct device *dev) { [...] dev = get_device(dev); <---- refcount++ (to 2) [...] done: put_device(dev); <----- refcount-- (back to 1) return error; > At stable state, the refcount is two. > > Console unregistration looks like this: > > unregister_console_locked(con) > struct device *dev = console->classdev; > console->classdev = NULL; > device_unregister(dev) > device_del(dev) > device_remove_class_symlinks(dev) > sysfs_delete_link() > kernfs_remove_by_name_ns() > __kernfs_remove() > kernfs_drain() > kernfs_drain_open_files() # wait for close() > kobject_del(&dev->kobj) # removes from sysfs, does NOT change refcount > put_device(dev) # kref_put: refcount-- (from 2 to 1) > put_device(dev) # kref_put: refcount-- (from 1 to 0) This extra put_device() is superfluous and must not be called, see below. > kobject_release() > kobject_cleanup() > device_release() > console_classdev_release(dev) > kfree(dev) > --- a/kernel/printk/printk.c > +++ b/kernel/printk/printk.c > @@ -4379,6 +4383,13 @@ static int unregister_console_locked(struct console *console) > if (console->flags & CON_NBCON) > nbcon_free(console); > > + if (console->classdev) { > + struct device *dev = console->classdev; > + console->classdev = NULL; > + device_unregister(dev); > + put_device(dev); The WARNING has gone after I removed this extra put_device(). And it seems to work well. The sysfs interface gets removed... Just for record. I tried to load/remove the "ttynull" module several times and it worked as well. > + } > + > console_sysfs_notify(); > > if (console->exit) Best Regards, Petr