linux/drivers/base/bus.c, branch v4.0

driver core: Fix unbalanced device reference in drivers_probe

2014-11-07T19:17:27Z

bus_find_device_by_name() acquires a device reference which is never released. This results in an object leak, which on older kernels results in failure to release all resources of PCI devices. libvirt uses drivers_probe to re-attach devices to the host after assignment and is therefore a common trigger for this leak. Example: # cd /sys/bus/pci/ # dmesg -C # echo 1 > devices/0000\:01\:00.0/sriov_numvfs # echo 0 > devices/0000\:01\:00.0/sriov_numvfs # dmesg | grep 01:10 pci 0000:01:10.0: [8086:10ca] type 00 class 0x020000 kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_add_internal: parent: '0000:00:01.0', set: 'devices' kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_uevent_env kobject: '0000:01:10.0' (ffff8801d79cd0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0' kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_uevent_env kobject: '0000:01:10.0' (ffff8801d79cd0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0' kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_uevent_env kobject: '0000:01:10.0' (ffff8801d79cd0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0' kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_cleanup, parent (null) kobject: '0000:01:10.0' (ffff8801d79cd0a8): calling ktype release kobject: '0000:01:10.0': free name [kobject freed as expected] # dmesg -C # echo 1 > devices/0000\:01\:00.0/sriov_numvfs # echo 0000:01:10.0 > drivers_probe # echo 0 > devices/0000\:01\:00.0/sriov_numvfs # dmesg | grep 01:10 pci 0000:01:10.0: [8086:10ca] type 00 class 0x020000 kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_add_internal: parent: '0000:00:01.0', set: 'devices' kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_uevent_env kobject: '0000:01:10.0' (ffff8801d79ce0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0' kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_uevent_env kobject: '0000:01:10.0' (ffff8801d79ce0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0' kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_uevent_env kobject: '0000:01:10.0' (ffff8801d79ce0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0' [no free] Signed-off-by: Alex Williamson Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman

Merge branch 'master' into for-next

2014-02-20T13:54:28Z

treewide: Fix typo in Documentation/DocBook

2014-02-19T13:58:17Z

This patch fix spelling typo in Documentation/DocBook. It is because .html and .xml files are generated by make htmldocs, I have to fix a typo within the source files. Signed-off-by: Masanari Iida Acked-by: Randy Dunlap Signed-off-by: Jiri Kosina

driver-core: Fix use-after-free triggered by bus_unregister()

2014-01-08T23:36:18Z

Avoid that bus_unregister() triggers a use-after-free with CONFIG_DEBUG_KOBJECT_RELEASE=y. This patch avoids that the following sequence triggers a kernel crash with memory poisoning enabled: * bus_register() * driver_register() * driver_unregister() * bus_unregister() The above sequence causes the bus private data to be freed from inside the bus_unregister() call although it is not guaranteed in that function that the reference count on the bus private data has dropped to zero. As an example, with CONFIG_DEBUG_KOBJECT_RELEASE=y the ${bus}/drivers kobject is still holding a reference on bus->p->subsys.kobj via its parent pointer at the time the bus private data is freed. Fix this by deferring freeing the bus private data until the last kobject_put() call on bus->p->subsys.kobj. The kernel oops triggered by the above sequence and with memory poisoning enabled and that is fixed by this patch is as follows: general protection fault: 0000 [#1] PREEMPT SMP CPU: 3 PID: 2711 Comm: kworker/3:32 Tainted: G W O 3.13.0-rc4-debug+ #1 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Workqueue: events kobject_delayed_cleanup task: ffff880037f866d0 ti: ffff88003b638000 task.ti: ffff88003b638000 Call Trace: [] ? kobject_get_path+0x25/0x100 [] kobject_uevent_env+0x134/0x600 [] kobject_uevent+0xb/0x10 [] kobject_delayed_cleanup+0xc2/0x1b0 [] process_one_work+0x217/0x700 [] ? process_one_work+0x1ab/0x700 [] worker_thread+0x11b/0x3a0 [] ? process_one_work+0x700/0x700 [] kthread+0xf0/0x110 [] ? insert_kthread_work+0x80/0x80 [] ret_from_fork+0x7c/0xb0 [] ? insert_kthread_work+0x80/0x80 Code: 89 f8 48 89 e5 f6 82 c0 27 63 81 20 74 15 0f 1f 44 00 00 48 83 c0 01 0f b6 10 f6 82 c0 27 63 81 20 75 f0 5d c3 66 0f 1f 44 00 00 <80> 3f 00 55 48 89 e5 74 15 48 89 f8 0f 1f 40 00 48 83 c0 01 80 RIP [] strlen+0x0/0x30 RSP ---[ end trace 210f883ef80376aa ]--- Signed-off-by: Bart Van Assche Acked-by: Ming Lei Signed-off-by: Greg Kroah-Hartman

driver-core: remove struct bus_type.drv_attrs

2013-09-28T17:18:20Z

Now that all in-kernel users of bus_type.drv_attrs have been converted to use drv_groups instead, the drv_attrs field, and logic surrounding it, can be removed. Signed-off-by: Greg Kroah-Hartman

driver-core: remove struct bus_type.bus_attrs

2013-09-28T15:32:11Z

Now that all in-kernel users of bus_type.bus_attrs have been converted to use bus_groups instead, the bus_attrs field, and logic surrounding it, can be removed. Signed-off-by: Greg Kroah-Hartman

driver core: add #include to core files.

2013-08-27T17:24:15Z

This is needed to fix the build on sh systems. Reported-by: kbuild test robot Signed-off-by: Greg Kroah-Hartman

driver core: bus: use DRIVER_ATTR_WO()

2013-08-23T22:04:42Z

There are two bus attributes that can better be defined using DRIVER_ATTR_WO(), so convert them to the new macro, making it easier to audit attribute permissions. Signed-off-by: Greg Kroah-Hartman

sysfs.h: remove attr_name() macro

2013-08-22T17:25:34Z

Gotta love a macro that doesn't reduce the typing you have to do. Also, only the driver core, and one network driver uses this. The driver core functions will be going away soon, and I'll convert the network driver soon to not need this as well, so delete it for now before anyone else gets some bright ideas and wants to use it. Signed-off-by: Greg Kroah-Hartman

sysfs: add sysfs_create/remove_groups()

2013-08-21T23:02:19Z

These functions are being open-coded in 3 different places in the driver core, and other driver subsystems will want to start doing this as well, so move it to the sysfs core to keep it all in one place, where we know it is written properly. Signed-off-by: Greg Kroah-Hartman