| Message ID | 20200614053801.94112-1-navid.emamdoost@gmail.com |
|---|---|
| State | Changes Requested |
| Delegated to: | David Miller |
| Headers | show |
| Series | net: fec: fix ref count leaking when pm_runtime_get_sync fails | expand |
From: Navid Emamdoost <navid.emamdoost@gmail.com> Date: Sun, 14 Jun 2020 00:38:01 -0500 > in fec_enet_mdio_read, fec_enet_mdio_write, fec_enet_get_regs, > fec_enet_open and fec_drv_remove, pm_runtime_get_sync is called which > increments the counter even in case of failure, leading to incorrect > ref count. In case of failure, decrement the ref count before returning. > > Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> This does not apply to the net tree.
From: David Miller <davem@davemloft.net> Sent: Tuesday, June 16, 2020 4:42 AM > From: Navid Emamdoost <navid.emamdoost@gmail.com> > Date: Sun, 14 Jun 2020 00:38:01 -0500 > > > in fec_enet_mdio_read, fec_enet_mdio_write, fec_enet_get_regs, > > fec_enet_open and fec_drv_remove, pm_runtime_get_sync is called which > > increments the counter even in case of failure, leading to incorrect > > ref count. In case of failure, decrement the ref count before returning. > > > > Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> > > This does not apply to the net tree. Wolfram Sang wonder if such de-reference can be better handled by pm runtime core code. https://lkml.org/lkml/2020/6/14/76
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c index dc6f8763a5d4..a33012b89cc9 100644 --- a/drivers/net/ethernet/freescale/fec_main.c +++ b/drivers/net/ethernet/freescale/fec_main.c @@ -1827,8 +1827,10 @@ static int fec_enet_mdio_read(struct mii_bus *bus, int mii_id, int regnum) bool is_c45 = !!(regnum & MII_ADDR_C45); ret = pm_runtime_get_sync(dev); - if (ret < 0) + if (ret < 0) { + pm_runtime_put_autosuspend(dev); return ret; + } reinit_completion(&fep->mdio_done); @@ -1893,8 +1895,10 @@ static int fec_enet_mdio_write(struct mii_bus *bus, int mii_id, int regnum, bool is_c45 = !!(regnum & MII_ADDR_C45); ret = pm_runtime_get_sync(dev); - if (ret < 0) + if (ret < 0) { + pm_runtime_put_autosuspend(dev); return ret; + } else ret = 0; @@ -2258,7 +2262,7 @@ static void fec_enet_get_regs(struct net_device *ndev, ret = pm_runtime_get_sync(dev); if (ret < 0) - return; + goto out; regs->version = fec_enet_register_version; @@ -2276,6 +2280,7 @@ static void fec_enet_get_regs(struct net_device *ndev, } pm_runtime_mark_last_busy(dev); +out: pm_runtime_put_autosuspend(dev); } @@ -2952,8 +2957,10 @@ fec_enet_open(struct net_device *ndev) bool reset_again; ret = pm_runtime_get_sync(&fep->pdev->dev); - if (ret < 0) + if (ret < 0) { + pm_runtime_put_autosuspend(&fep->pdev->dev); return ret; + } pinctrl_pm_select_default_state(&fep->pdev->dev); ret = fec_enet_clk_enable(ndev, true); @@ -3741,8 +3748,10 @@ fec_drv_remove(struct platform_device *pdev) int ret; ret = pm_runtime_get_sync(&pdev->dev); - if (ret < 0) + if (ret < 0) { + pm_runtime_put_noidle(&pdev->dev); return ret; + } cancel_work_sync(&fep->tx_timeout_work); fec_ptp_stop(pdev);
in fec_enet_mdio_read, fec_enet_mdio_write, fec_enet_get_regs, fec_enet_open and fec_drv_remove, pm_runtime_get_sync is called which increments the counter even in case of failure, leading to incorrect ref count. In case of failure, decrement the ref count before returning. Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> --- drivers/net/ethernet/freescale/fec_main.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)