diff options
author | Daniel Axtens <dja@axtens.net> | 2015-09-15 15:04:07 +1000 |
---|---|---|
committer | Michael Ellerman <mpe@ellerman.id.au> | 2015-09-15 19:33:38 +1000 |
commit | 2925c2fdf1e0eb642482f5b30577e9435aaa8edb (patch) | |
tree | f2a3a87f86912ee53c195d512f05e95453c24cdd /net/l2tp | |
parent | e297c939b745e420ef0b9dc989cb87bda617b399 (diff) | |
download | op-kernel-dev-2925c2fdf1e0eb642482f5b30577e9435aaa8edb.zip op-kernel-dev-2925c2fdf1e0eb642482f5b30577e9435aaa8edb.tar.gz |
cxl: Fix unbalanced pci_dev_get in cxl_probe
Currently the first thing we do in cxl_probe is to grab a reference
on the pci device. Later on, we call device_register on our adapter.
In our remove path, we call device_unregister, but we never call
pci_dev_put. We therefore leak the device every time we do a
reflash.
device_register/unregister is sufficient to hold the reference.
Therefore, drop the call to pci_dev_get.
Here's why this is safe.
The proposed cxl_probe(pdev) calls cxl_adapter_init:
a) init calls cxl_adapter_alloc, which creates a struct cxl,
conventionally called adapter. This struct contains a
device entry, adapter->dev.
b) init calls cxl_configure_adapter, where we set
adapter->dev.parent = &dev->dev (here dev is the pci dev)
So at this point, the cxl adapter's device's parent is the PCI
device that I want to be refcounted properly.
c) init calls cxl_register_adapter
*) cxl_register_adapter calls device_register(&adapter->dev)
So now we're in device_register, where dev is the adapter device, and
we want to know if the PCI device is safe after we return.
device_register(&adapter->dev) calls device_initialize() and then
device_add().
device_add() does a get_device(). device_add() also explicitly grabs
the device's parent, and calls get_device() on it:
parent = get_device(dev->parent);
So therefore, device_register() takes a lock on the parent PCI dev,
which is what pci_dev_get() was guarding. pci_dev_get() can therefore
be safely removed.
Fixes: f204e0b8cedd ("cxl: Driver code for powernv PCIe based cards for userspace access")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Axtens <dja@axtens.net>
Acked-by: Ian Munsie <imunsie@au1.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Diffstat (limited to 'net/l2tp')
0 files changed, 0 insertions, 0 deletions