From patchwork Thu May 18 06:25:11 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Claudiu Beznea X-Patchwork-Id: 13246215 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id D6C4FC7EE24 for ; Thu, 18 May 2023 06:25:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Date:Subject:CC :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=CWIa0TOxdGM3bZqNtzgNgzhgtdi91YnEdcU5jV982Rs=; b=mTINsPYMnoUWu1 oumslT6P+Qf2BI/4wSctMhZJO/gquKFW8nlrZ//Vhem8v6+4Um9TqIydZJZooiNlATDsnpECIWo7T r4hcZ+NQItUM8RhKieFSpyISVzqSopjv7JZIP23qpzS4SPvRAt/ECCTlzcfqW7lVhsekIfAowGUp4 llXwZgfHFAlFfzRS/01AjrNcVO09Y2vZB1h66hCnPo/pqE2mRAFoQoDJSQgvwSq6X0M+VSKBj/P/l Q4NBbzmcw7BBsQ3U32o48++5/sukGIMhVzSQBzz68Nzva//h43s3m/6gtx3C87RsMbvtdQbuRrD1S n3Ncr6FYrdU1zjCHbP0g==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1pzX4r-00C4Hf-0H; Thu, 18 May 2023 06:25:29 +0000 Received: from esa.microchip.iphmx.com ([68.232.154.123]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1pzX4n-00C4Gq-0K for linux-arm-kernel@lists.infradead.org; Thu, 18 May 2023 06:25:27 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=microchip.com; i=@microchip.com; q=dns/txt; s=mchp; t=1684391125; x=1715927125; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=k2ASCXTUiR6CdVuxJ/NidGjmihaBal4ilojdkFQY0ZE=; b=oxPAtE7K8+MSrkQRy2VVnz1ldkCMODNmNKa9feuwU0g7mdY91A6VVrlA i1gjGOMiHv+zWqAvObItRjOtFrq5djDncP4Lo5ibsXklMxgL/wueayDrk nV4kX31TCAfo4HnYH2mCLnu418bsvJcosM9k/acj5+Y0jMZ1pwVqSgZRH WOAKE/YvJAw2Q5UubtoLTeFXdUKVlUYhVbvE5htXmkW8q1nPVchl3mxBW p9JgQowgplkLPWAegwBsejVFs0LtfDxeCC9IL+M0i8YNPk605lRx9n0Kz Xtk7JdKy5ZtGK6tuiBiCaKOQLVjExU0WYmXRSTQ/2NYQklMur8VEEv0YB w==; X-IronPort-AV: E=Sophos;i="5.99,284,1677567600"; d="scan'208";a="216039913" X-Amp-Result: SKIPPED(no attachment in message) Received: from unknown (HELO email.microchip.com) ([170.129.1.10]) by esa2.microchip.iphmx.com with ESMTP/TLS/AES256-SHA256; 17 May 2023 23:25:24 -0700 Received: from chn-vm-ex01.mchp-main.com (10.10.85.143) by chn-vm-ex01.mchp-main.com (10.10.85.143) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.21; Wed, 17 May 2023 23:25:23 -0700 Received: from m18063-ThinkPad-T460p.mchp-main.com (10.10.115.15) by chn-vm-ex01.mchp-main.com (10.10.85.143) with Microsoft SMTP Server id 15.1.2507.21 via Frontend Transport; Wed, 17 May 2023 23:25:21 -0700 From: Claudiu Beznea To: , , CC: , , Claudiu Beznea Subject: [PATCH] ARM: at91: pm: fix imbalanced reference counter for ethernet devices Date: Thu, 18 May 2023 09:25:11 +0300 Message-ID: <20230518062511.2988500-1-claudiu.beznea@microchip.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230517_232525_399254_1E88CD92 X-CRM114-Status: GOOD ( 17.22 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The of_find_device_by_node() function is returning a struct platform_device object with the embedded struct device member's reference counter incremented. This needs to be dropped when done with the platform device returned by of_find_device_by_node(). at91_pm_eth_quirk_is_valid() calls of_find_device_by_node() on suspend and resume path. On suspend it calls of_find_device_by_node() and on resume and failure paths it drops the counter of struct platform_device::dev. In case ethernet device may not wakeup there is a put_device() on at91_pm_eth_quirk_is_valid() which is wrong as it colides with put_device() on resume path leading to the reference counter of struct device embedded in struct platform_device to be messed, the following stack trace to be displayed (after 5 consecutive suspend/resume cycles) and the execution to hang: WARNING: CPU: 0 PID: 378 at lib/refcount.c:25 0xc07ffc08 refcount_t: addition on 0; use-after-free. Modules linked in: CPU: 0 PID: 378 Comm: sh Not tainted 6.1.22-linux4microchip-2023.04-rc3+ #7 Hardware name: Microchip SAMA7 Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Exception stack(0xe0e81fa8 to 0xe0e81ff0) 1fa0: 00000004 0057c668 00000001 0057c668 00000004 00000000 1fc0: 00000004 0057c668 b6ecaba0 00000004 b6f4c0e0 b6ecb15c 00000000 00000000 1fe0: 005456f0 beb3a788 b6dcfac4 b6e3bab8 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ WARNING: CPU: 0 PID: 378 at lib/refcount.c:28 0xc045fef4 refcount_t: underflow; use-after-free. Modules linked in: CPU: 0 PID: 378 Comm: sh Tainted: G W 6.1.22-linux4microchip-2023.04-rc3+ #7 Hardware name: Microchip SAMA7 Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Exception stack(0xe0e81fa8 to 0xe0e81ff0) 1fa0: 00000004 0057c668 00000001 0057c668 00000004 00000000 1fc0: 00000004 0057c668 b6ecaba0 00000004 b6f4c0e0 b6ecb15c 00000000 00000000 1fe0: 005456f0 beb3a788 b6dcfac4 b6e3bab8 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ WARNING: CPU: 0 PID: 378 at lib/refcount.c:22 0xc07ffbf4 refcount_t: saturated; leaking memory. Modules linked in: CPU: 0 PID: 378 Comm: sh Tainted: G W 6.1.22-linux4microchip-2023.04-rc3+ #7 Hardware name: Microchip SAMA7 Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Exception stack(0xe0e81fa8 to 0xe0e81ff0) 1fa0: 00000004 0057c668 00000001 0057c668 00000004 00000000 1fc0: 00000004 0057c668 b6ecaba0 00000004 b6f4c0e0 b6ecb15c 00000000 00000000 1fe0: 005456f0 beb3a788 b6dcfac4 b6e3bab8 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ WARNING: CPU: 0 PID: 378 at kernel/irq/chip.c:241 0xc014be2c Modules linked in: CPU: 0 PID: 378 Comm: sh Tainted: G W 6.1.22-linux4microchip-2023.04-rc3+ #7 Hardware name: Microchip SAMA7 Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Exception stack(0xe0e81fa8 to 0xe0e81ff0) 1fa0: 00000004 0057c668 00000001 0057c668 00000004 00000000 1fc0: 00000004 0057c668 b6ecaba0 00000004 b6f4c0e0 b6ecb15c 00000000 00000000 1fe0: 005456f0 beb3a788 b6dcfac4 b6e3bab8 ---[ end trace 0000000000000000 ]--- at_xdmac e1200000.dma-controller: controller in mem2mem mode. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 378 at lib/kobject.c:634 0xc07ffbe8 kobject: '$���"����L��L��' (a3ba4c7d): is not initialized, yet kobject_get() is being called. Modules linked in: CPU: 0 PID: 378 Comm: sh Tainted: G W 6.1.22-linux4microchip-2023.04-rc3+ #7 Hardware name: Microchip SAMA7 Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Exception stack(0xe0e81fa8 to 0xe0e81ff0) 1fa0: 00000004 0057c668 00000001 0057c668 00000004 00000000 1fc0: 00000004 0057c668 b6ecaba0 00000004 b6f4c0e0 b6ecb15c 00000000 00000000 1fe0: 005456f0 beb3a788 b6dcfac4 b6e3bab8 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ WARNING: CPU: 0 PID: 378 at lib/kobject.c:728 0xc07ffd7c kobject: '$���"����L��L��' (a3ba4c7d): is not initialized, yet kobject_put() is being called. Modules linked in: CPU: 0 PID: 378 Comm: sh Tainted: G W 6.1.22-linux4microchip-2023.04-rc3+ #7 Hardware name: Microchip SAMA7 Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Exception stack(0xe0e81fa8 to 0xe0e81ff0) 1fa0: 00000004 0057c668 00000001 0057c668 00000004 00000000 1fc0: 00000004 0057c668 b6ecaba0 00000004 b6f4c0e0 b6ecb15c 00000000 00000000 1fe0: 005456f0 beb3a788 b6dcfac4 b6e3bab8 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ WARNING: CPU: 0 PID: 378 at lib/kobject.c:634 0xc07ffbe8 kobject: '�Z����@Ą�?��8�H�Ĕ����UC�' (6407eb2a): is not initialized, yet kobject_get() is being called. Modules linked in: CPU: 0 PID: 378 Comm: sh Tainted: G W 6.1.22-linux4microchip-2023.04-rc3+ #7 Hardware name: Microchip SAMA7 Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Function entered at [] from [] Exception stack(0xe0e81fa8 to 0xe0e81ff0) 1fa0: 00000004 0057c668 00000001 0057c668 00000004 00000000 1fc0: 00000004 0057c668 b6ecaba0 00000004 b6f4c0e0 b6ecb15c 00000000 00000000 1fe0: 005456f0 beb3a788 b6dcfac4 b6e3bab8 ---[ end trace 0000000000000000 ]--- Along with this the error path of at91_pm_config_quirks() had been also adapted to decrement propertly the reference counter of struct device embedded in struct platform_device. Fixes: b7fc72c63399 ("ARM: at91: pm: add quirks for pm") Signed-off-by: Claudiu Beznea Acked-by: Nicolas Ferre --- arch/arm/mach-at91/pm.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c index 60dc56d8acfb..437dd0352fd4 100644 --- a/arch/arm/mach-at91/pm.c +++ b/arch/arm/mach-at91/pm.c @@ -334,16 +334,14 @@ static bool at91_pm_eth_quirk_is_valid(struct at91_pm_quirk_eth *eth) pdev = of_find_device_by_node(eth->np); if (!pdev) return false; + /* put_device(eth->dev) is called at the end of suspend. */ eth->dev = &pdev->dev; } /* No quirks if device isn't a wakeup source. */ - if (!device_may_wakeup(eth->dev)) { - put_device(eth->dev); + if (!device_may_wakeup(eth->dev)) return false; - } - /* put_device(eth->dev) is called at the end of suspend. */ return true; } @@ -439,14 +437,14 @@ static int at91_pm_config_quirks(bool suspend) pr_err("AT91: PM: failed to enable %s clocks\n", j == AT91_PM_G_ETH ? "geth" : "eth"); } - } else { - /* - * Release the reference to eth->dev taken in - * at91_pm_eth_quirk_is_valid(). - */ - put_device(eth->dev); - eth->dev = NULL; } + + /* + * Release the reference to eth->dev taken in + * at91_pm_eth_quirk_is_valid(). + */ + put_device(eth->dev); + eth->dev = NULL; } return ret;