From patchwork Tue Nov 22 18:07:30 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Geert Uytterhoeven X-Patchwork-Id: 9441877 X-Patchwork-Delegate: geert@linux-m68k.org Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 16E8A6075F for ; Tue, 22 Nov 2016 18:10:26 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0B6FD285AE for ; Tue, 22 Nov 2016 18:10:26 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 004C8285BA; Tue, 22 Nov 2016 18:10:25 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 77466285B1 for ; Tue, 22 Nov 2016 18:10:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934150AbcKVSJl (ORCPT ); Tue, 22 Nov 2016 13:09:41 -0500 Received: from newton.telenet-ops.be ([195.130.132.45]:59132 "EHLO newton.telenet-ops.be" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755741AbcKVSJZ (ORCPT ); Tue, 22 Nov 2016 13:09:25 -0500 Received: from michel.telenet-ops.be (michel.telenet-ops.be [IPv6:2a02:1800:110:4::f00:18]) by newton.telenet-ops.be (Postfix) with ESMTPS id 3tNYPY0xFqzMrFPG for ; Tue, 22 Nov 2016 19:08:49 +0100 (CET) Received: from ayla.of.borg ([84.193.137.253]) by michel.telenet-ops.be with bizsmtp id B67Z1u0015UCtCs0667ZP3; Tue, 22 Nov 2016 19:07:33 +0100 Received: from ramsan.of.borg ([192.168.97.29] helo=ramsan) by ayla.of.borg with esmtp (Exim 4.82) (envelope-from ) id 1c9FTg-0003gI-Uk; Tue, 22 Nov 2016 19:07:32 +0100 Received: from geert by ramsan with local (Exim 4.82) (envelope-from ) id 1c9FTh-0007Xg-Ua; Tue, 22 Nov 2016 19:07:33 +0100 From: Geert Uytterhoeven To: Florian Fainelli , "David S. Miller" , Josh Cartwright , Nathan Sullivan , Zach Brown Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Geert Uytterhoeven Subject: [PATCH/RFC -next] net: phy: Fix double free in phy_detach() Date: Tue, 22 Nov 2016 19:07:30 +0100 Message-Id: <1479838050-28957-1-git-send-email-geert+renesas@glider.be> X-Mailer: git-send-email 1.9.1 Sender: linux-renesas-soc-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-renesas-soc@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP During "poweroff" on sh73a0/kzm9g: WARNING: CPU: 0 PID: 1271 at drivers/base/devres.c:889 phy_detach+0x44/0x60 Modules linked in: CPU: 0 PID: 1271 Comm: halt Not tainted 4.9.0-rc6-kzm9g-05637-gb090128865050239 #823 Hardware name: Generic SH73A0 (Flattened Device Tree) [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [] (show_stack) from [] (dump_stack+0xa4/0xdc) [] (dump_stack) from [] (__warn+0xcc/0xfc) [] (__warn) from [] (warn_slowpath_null+0x1c/0x24) [] (warn_slowpath_null) from [] (phy_detach+0x44/0x60) [] (phy_detach) from [] (smsc911x_stop+0xf4/0x10c) [] (smsc911x_stop) from [] (__dev_close_many+0x94/0xb8) [] (__dev_close_many) from [] (__dev_close+0x20/0x34) [] (__dev_close) from [] (__dev_change_flags+0x8c/0x130) [] (__dev_change_flags) from [] (dev_change_flags+0x18/0x48) [] (dev_change_flags) from [] (devinet_ioctl+0x33c/0x708) [] (devinet_ioctl) from [] (sock_ioctl+0x29c/0x2f8) [] (sock_ioctl) from [] (vfs_ioctl+0x20/0x34) [] (vfs_ioctl) from [] (do_vfs_ioctl+0x870/0x9c4) [] (do_vfs_ioctl) from [] (SyS_ioctl+0x34/0x5c) [] (SyS_ioctl) from [] (ret_fast_syscall+0x0/0x1c) ---[ end trace 4555b9be7369b463 ]--- If device_release_driver(&phydev->mdio.dev) was called, it has already released all resources belonging to the PHY device. Hence the subsequent call to phy_led_triggers_unregister() may cause a double free, leading to the warning. Move the call to phy_led_triggers_unregister() before the possible call to device_release_driver() to fix this. Fixes: 2e0bc452f4721520 ("net: phy: leds: add support for led triggers on phy link state change") Signed-off-by: Geert Uytterhoeven --- Is this the right fix? --- drivers/net/phy/phy_device.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c index 9e8f048891bd192f..b32457660db66de4 100644 --- a/drivers/net/phy/phy_device.c +++ b/drivers/net/phy/phy_device.c @@ -981,6 +981,8 @@ void phy_detach(struct phy_device *phydev) phydev->attached_dev = NULL; phy_suspend(phydev); + phy_led_triggers_unregister(phydev); + /* If the device had no specific driver before (i.e. - it * was using the generic driver), we unbind the device * from the generic driver so that there's a chance a @@ -994,8 +996,6 @@ void phy_detach(struct phy_device *phydev) } } - phy_led_triggers_unregister(phydev); - /* * The phydev might go away on the put_device() below, so avoid * a use-after-free bug by reading the underlying bus first.