From patchwork Sat Jun 2 00:03:43 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Srinivas Kandagatla X-Patchwork-Id: 10444439 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 1EAE060234 for ; Sat, 2 Jun 2018 00:06:17 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0D36C28AAE for ; Sat, 2 Jun 2018 00:06:17 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 0173728ABC; Sat, 2 Jun 2018 00:06:16 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,MAILING_LIST_MULTI autolearn=unavailable version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 9257E28AAE for ; Sat, 2 Jun 2018 00:06:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: Subject:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Owner; bh=8i88xJxcacmWq68/cAiFg2y+JGHifgOlAzVxIbfM/3c=; b=SF1 ajM7hYWdIvEv2oFc6OB8eCAtjp12BFpMZjpv1pNF3SPwhoeiDAJ861zKuBRpHqLPjXtN14EF53C3J HrLOa0qsTMWqhAs4xr0gN32oIahMdE4v6rS+iiflFnxKyB3LpWfvuYBFz1tNCCpx4VC9RqywvkXDP UfUB6byzu27VP5dOF7kUETd/bdF2xiI97tyaKc5n1c41SiCErp/2jVNu2E4NLFrkK6Bgs78XcI4Ns OI4E5CtO9qvGtREIKj+D171FQVH8B2XwQRywGUzxlrvyqVO+Y+PwvtgqedvsPrQD/zlU0F/Zb3xYK 0V2Sul/Jixt/RBXzCRdHpHGcxVdeIvQ==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1fOu3b-0005wn-BR; Sat, 02 Jun 2018 00:06:07 +0000 Received: from mail-wr0-x244.google.com ([2a00:1450:400c:c0c::244]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1fOu3V-0005sl-Sm for linux-arm-kernel@lists.infradead.org; Sat, 02 Jun 2018 00:06:04 +0000 Received: by mail-wr0-x244.google.com with SMTP id v13-v6so26079108wrp.13 for ; Fri, 01 Jun 2018 17:05:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id; bh=wn6Agb+5TcRSiwYPl38oPGp/MMRVEjg46nuQ2bUWxvs=; b=L6/nnov5hAqpymvODyVQc6LXrpOPxATC5o+9BLoSixUzidmwo1iB6MQNb+sLZqqI8M Z/bjTTUyFC02YpgnSE4sHeSlivT1VOhVeaBbQ1x5JrDyVpXsmPMJI67wY/S92On3TEp+ wwTtXFC+Ms2RPWBMtP43F5TNhK4CuSyxVPJ6s= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=wn6Agb+5TcRSiwYPl38oPGp/MMRVEjg46nuQ2bUWxvs=; b=Mr5ke8gazviqKc9EiVC7D5Fi52rushfHbKPhvFV34TTCDTTGRH8w5y8KT9oCaE1ywF kLE3Zt6NDLtVHcBD0cGfuXeHtMRqOPAocDtO0ohfS8XaAvPi9rwWBdQ6lCZA8Rn9KK5V OyN5chuK4DAQaV00B0FpAGsSLYZE9o9KaO1u/zvczcy9lnUMSgI1/FMTqe8Mc5tj0hnI 7t06h8f0BOxNBpOux0EwI8AE9brYCn4TEJ93sEfipx49ZW5Obql6jN58Vir20qeofTfb BFp8LTi25AX3ERaprruAUAU13mRqJwRuLzAKMBsyt+/Ax3a77WTUVplFzRhgth4NKFGv VGLQ== X-Gm-Message-State: ALKqPwc2bXM008EvVk0p4EgCC+Nyyd1+bHxBcECh2BHD7iNgpL0EZiBh cKWqvSM3D8dy4SYWTR3LM78XTg== X-Google-Smtp-Source: ADUXVKLjErJqwTkTNqeTmLmwvvaf1MSCkm17VP1ewezBZyJIizVqa3dCElSp8sgy4IqDb3jHa/sNNw== X-Received: by 2002:adf:a54a:: with SMTP id j10-v6mr10998126wrb.155.1527897949193; Fri, 01 Jun 2018 17:05:49 -0700 (PDT) Received: from localhost.localdomain (cpc90716-aztw32-2-0-cust92.18-1.cable.virginm.net. [86.26.100.93]) by smtp.gmail.com with ESMTPSA id e13-v6sm25626947wrm.45.2018.06.01.17.05.47 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 01 Jun 2018 17:05:47 -0700 (PDT) From: Srinivas Kandagatla To: robh+dt@kernel.org, frowand.list@gmail.com Subject: [PATCH v2] of: platform: stop accessing invalid dev in of_platform_device_destroy Date: Sat, 2 Jun 2018 01:03:43 +0100 Message-Id: <20180602000343.20045-1-srinivas.kandagatla@linaro.org> X-Mailer: git-send-email 2.16.2 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180601_170601_933243_9644E30D X-CRM114-Status: GOOD ( 14.24 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: rohkumar@qti.qualcomm.com, devicetree@vger.kernel.org, bgoswami@codeaurora.org, linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, Srinivas Kandagatla , linux-arm-kernel@lists.infradead.org MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP Immediately after the platform_device_unregister() the device will be cleaned up. Accessing the freed pointer immediately after that will crash the system. Found this bug when kernel is built with CONFIG_PAGE_POISONING and testing loading/unloading audio drivers in a loop on Qcom platforms. Fix this by removing accessing the dev pointer. Below is the carsh trace: Unable to handle kernel paging request at virtual address 6b6b6b6b6b6c03 Mem abort info: ESR = 0x96000021 Exception class = DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000021 CM = 0, WnR = 0 [006b6b6b6b6b6c03] address between user and kernel address ranges Internal error: Oops: 96000021 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 1784 Comm: sh Tainted: G W 4.17.0-rc7-02230-ge3a63a7ef641-dirty #204 Hardware name: Qualcomm Technologies, Inc. APQ 8016 SBC (DT) pstate: 80000005 (Nzcv daif -PAN -UAO) pc : clear_bit+0x18/0x2c lr : of_platform_device_destroy+0x64/0xb8 sp : ffff00000c9c3930 x29: ffff00000c9c3930 x28: ffff80003d39b200 x27: ffff000008bb1000 x26: 0000000000000040 x25: 0000000000000124 x24: ffff80003a9a3080 x23: 0000000000000060 x22: ffff00000939f518 x21: ffff80003aa79e98 x20: ffff80003aa3dae0 x19: ffff80003aa3c890 x18: ffff800009feb794 x17: 0000000000000000 x16: 0000000000000000 x15: ffff800009feb790 x14: 0000000000000000 x13: ffff80003a058778 x12: ffff80003a058728 x11: ffff80003a058750 x10: 0000000000000000 x9 : 0000000000000006 x8 : ffff80003a825988 x7 : bbbbbbbbbbbbbbbb x6 : 0000000000000001 x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000008 x2 : 0000000000000001 x1 : 6b6b6b6b6b6b6c03 x0 : 0000000000000000 Process sh (pid: 1784, stack limit = 0x (ptrval)) Call trace: clear_bit+0x18/0x2c q6afe_remove+0x20/0x38 apr_device_remove+0x30/0x70 device_release_driver_internal+0x170/0x208 device_release_driver+0x14/0x20 bus_remove_device+0xcc/0x150 device_del+0x10c/0x310 device_unregister+0x1c/0x70 apr_remove_device+0xc/0x18 device_for_each_child+0x50/0x80 apr_remove+0x18/0x20 rpmsg_dev_remove+0x38/0x68 device_release_driver_internal+0x170/0x208 device_release_driver+0x14/0x20 bus_remove_device+0xcc/0x150 device_del+0x10c/0x310 device_unregister+0x1c/0x70 qcom_smd_remove_device+0xc/0x18 device_for_each_child+0x50/0x80 qcom_smd_unregister_edge+0x3c/0x70 smd_subdev_remove+0x18/0x28 rproc_stop+0x48/0xd8 rproc_shutdown+0x60/0xe8 state_store+0xbc/0xf8 dev_attr_store+0x18/0x28 sysfs_kf_write+0x3c/0x50 kernfs_fop_write+0x118/0x1e0 __vfs_write+0x18/0x110 vfs_write+0xa4/0x1a8 ksys_write+0x48/0xb0 sys_write+0xc/0x18 el0_svc_naked+0x30/0x34 Code: d2800022 8b400c21 f9800031 9ac32043 (c85f7c22) Signed-off-by: Srinivas Kandagatla --- Changes since v1: - fixed issue while reprobing. drivers/of/platform.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/of/platform.c b/drivers/of/platform.c index c00d81dfac0b..84c5c899187b 100644 --- a/drivers/of/platform.c +++ b/drivers/of/platform.c @@ -529,10 +529,13 @@ arch_initcall_sync(of_platform_default_populate_init); int of_platform_device_destroy(struct device *dev, void *data) { + struct device_node *np; + /* Do not touch devices not populated from the device tree */ if (!dev->of_node || !of_node_check_flag(dev->of_node, OF_POPULATED)) return 0; + np = dev->of_node; /* Recurse for any nodes that were treated as busses */ if (of_node_check_flag(dev->of_node, OF_POPULATED_BUS)) device_for_each_child(dev, NULL, of_platform_device_destroy); @@ -544,8 +547,8 @@ int of_platform_device_destroy(struct device *dev, void *data) amba_device_unregister(to_amba_device(dev)); #endif - of_node_clear_flag(dev->of_node, OF_POPULATED); - of_node_clear_flag(dev->of_node, OF_POPULATED_BUS); + of_node_clear_flag(np, OF_POPULATED); + of_node_clear_flag(np, OF_POPULATED_BUS); return 0; } EXPORT_SYMBOL_GPL(of_platform_device_destroy);