Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-10 14:11:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

driver core: Fix DL_FLAG_AUTOREMOVE_SUPPLIER device link flag handling

Browse Source 
Change the list walk in device_links_driver_cleanup() to a safe one
to avoid use-after-free when dropping a link from the list during the
walk.

Also, while at it, fix device_link_add() to refuse to create
stateless device links with DL_FLAG_AUTOREMOVE_SUPPLIER set, which is
an invalid combination (setting that flag means that the driver core
should manage the link, so it cannot be stateless), and extend the
kerneldoc comment of device_link_add() to cover the
DL_FLAG_AUTOREMOVE_SUPPLIER flag properly too.

Fixes: 1689cac5b3 ("driver core: Add flag to autoremove device link on supplier unbind")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Rafael J. Wysocki 2019-02-01 01:45:55 +01:00 committed by Greg Kroah-Hartman
parent 8d84b18f56
commit c8d50986da
1 changed files with 12 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
drivers/base/core.c
View File

@ -179,10 +179,14 @@ void device_pm_move_to_tail(struct device *dev)
* of the link. If DL_FLAG_PM_RUNTIME is not set, DL_FLAG_RPM_ACTIVE will be
* ignored.
*
* If the DL_FLAG_AUTOREMOVE_CONSUMER is set, the link will be removed
* automatically when the consumer device driver unbinds from it.
* The combination of both DL_FLAG_AUTOREMOVE_CONSUMER and DL_FLAG_STATELESS
* set is invalid and will cause NULL to be returned.
* If the DL_FLAG_AUTOREMOVE_CONSUMER flag is set, the link will be removed
* automatically when the consumer device driver unbinds from it. Analogously,
* if DL_FLAG_AUTOREMOVE_SUPPLIER is set in @flags, the link will be removed
* automatically when the supplier device driver unbinds from it.
*
* The combination of DL_FLAG_STATELESS and either DL_FLAG_AUTOREMOVE_CONSUMER
* or DL_FLAG_AUTOREMOVE_SUPPLIER set in @flags at the same time is invalid and
* will cause NULL to be returned upfront.
*
* A side effect of the link creation is re-ordering of dpm_list and the
* devices_kset list by moving the consumer device and all devices depending
@ -199,8 +203,8 @@ struct device_link *device_link_add(struct device *consumer,
struct device_link *link;
if (!consumer || !supplier ||
((flags & DL_FLAG_STATELESS) &&
(flags & DL_FLAG_AUTOREMOVE_CONSUMER)))
(flags & DL_FLAG_STATELESS &&
flags & (DL_FLAG_AUTOREMOVE_CONSUMER | DL_FLAG_AUTOREMOVE_SUPPLIER)))
return NULL;
device_links_write_lock();
@ -539,11 +543,11 @@ void device_links_no_driver(struct device *dev)
*/
void device_links_driver_cleanup(struct device *dev)
{
struct device_link *link;
struct device_link *link, *ln;
device_links_write_lock();
list_for_each_entry(link, &dev->links.consumers, s_node) {
list_for_each_entry_safe(link, ln, &dev->links.consumers, s_node) {
if (link->flags & DL_FLAG_STATELESS)
continue;