提交 b2c8dadd 编写于 作者: D David Brownell 提交者: Linus Torvalds

spi: fix refcount-related spidev oops-on-rmmod

This addresses other oopsing paths in "spidev" by changing how it manages
refcounting.  It decouples the lifecycle of the per-device data from the
class device (not just the spi device):

  - Use class_{create,destroy} not class_{register,unregister}.
  - Use device_{create,destroy} not device_{register,unregister}.
  - Free the per-device data only when TWO conditions are true:
      * Driver is unbound from underlying SPI device, and
      * Device is no longer open (new)

Also, spi_{get,set}_drvdata not dev_{get,set}_drvdata for simpler code.
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Sebastian Siewior <bigeasy@tglx.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
上级 39b945a3
...@@ -25,6 +25,7 @@ ...@@ -25,6 +25,7 @@
#include <linux/ioctl.h> #include <linux/ioctl.h>
#include <linux/fs.h> #include <linux/fs.h>
#include <linux/device.h> #include <linux/device.h>
#include <linux/err.h>
#include <linux/list.h> #include <linux/list.h>
#include <linux/errno.h> #include <linux/errno.h>
#include <linux/mutex.h> #include <linux/mutex.h>
...@@ -67,11 +68,12 @@ static unsigned long minors[N_SPI_MINORS / BITS_PER_LONG]; ...@@ -67,11 +68,12 @@ static unsigned long minors[N_SPI_MINORS / BITS_PER_LONG];
| SPI_LSB_FIRST | SPI_3WIRE | SPI_LOOP) | SPI_LSB_FIRST | SPI_3WIRE | SPI_LOOP)
struct spidev_data { struct spidev_data {
struct device dev; dev_t devt;
spinlock_t spi_lock; spinlock_t spi_lock;
struct spi_device *spi; struct spi_device *spi;
struct list_head device_entry; struct list_head device_entry;
/* buffer is NULL unless this device is open (users > 0) */
struct mutex buf_lock; struct mutex buf_lock;
unsigned users; unsigned users;
u8 *buffer; u8 *buffer;
...@@ -467,7 +469,7 @@ static int spidev_open(struct inode *inode, struct file *filp) ...@@ -467,7 +469,7 @@ static int spidev_open(struct inode *inode, struct file *filp)
mutex_lock(&device_list_lock); mutex_lock(&device_list_lock);
list_for_each_entry(spidev, &device_list, device_entry) { list_for_each_entry(spidev, &device_list, device_entry) {
if (spidev->dev.devt == inode->i_rdev) { if (spidev->devt == inode->i_rdev) {
status = 0; status = 0;
break; break;
} }
...@@ -500,10 +502,22 @@ static int spidev_release(struct inode *inode, struct file *filp) ...@@ -500,10 +502,22 @@ static int spidev_release(struct inode *inode, struct file *filp)
mutex_lock(&device_list_lock); mutex_lock(&device_list_lock);
spidev = filp->private_data; spidev = filp->private_data;
filp->private_data = NULL; filp->private_data = NULL;
/* last close? */
spidev->users--; spidev->users--;
if (!spidev->users) { if (!spidev->users) {
int dofree;
kfree(spidev->buffer); kfree(spidev->buffer);
spidev->buffer = NULL; spidev->buffer = NULL;
/* ... after we unbound from the underlying device? */
spin_lock_irq(&spidev->spi_lock);
dofree = (spidev->spi == NULL);
spin_unlock_irq(&spidev->spi_lock);
if (dofree)
kfree(spidev);
} }
mutex_unlock(&device_list_lock); mutex_unlock(&device_list_lock);
...@@ -530,19 +544,7 @@ static struct file_operations spidev_fops = { ...@@ -530,19 +544,7 @@ static struct file_operations spidev_fops = {
* It also simplifies memory management. * It also simplifies memory management.
*/ */
static void spidev_classdev_release(struct device *dev) static struct class *spidev_class;
{
struct spidev_data *spidev;
spidev = container_of(dev, struct spidev_data, dev);
kfree(spidev);
}
static struct class spidev_class = {
.name = "spidev",
.owner = THIS_MODULE,
.dev_release = spidev_classdev_release,
};
/*-------------------------------------------------------------------------*/ /*-------------------------------------------------------------------------*/
...@@ -570,20 +572,20 @@ static int spidev_probe(struct spi_device *spi) ...@@ -570,20 +572,20 @@ static int spidev_probe(struct spi_device *spi)
mutex_lock(&device_list_lock); mutex_lock(&device_list_lock);
minor = find_first_zero_bit(minors, N_SPI_MINORS); minor = find_first_zero_bit(minors, N_SPI_MINORS);
if (minor < N_SPI_MINORS) { if (minor < N_SPI_MINORS) {
spidev->dev.parent = &spi->dev; struct device *dev;
spidev->dev.class = &spidev_class;
spidev->dev.devt = MKDEV(SPIDEV_MAJOR, minor); spidev->devt = MKDEV(SPIDEV_MAJOR, minor);
snprintf(spidev->dev.bus_id, sizeof spidev->dev.bus_id, dev = device_create(spidev_class, &spi->dev, spidev->devt,
"spidev%d.%d", "spidev%d.%d",
spi->master->bus_num, spi->chip_select); spi->master->bus_num, spi->chip_select);
status = device_register(&spidev->dev); status = IS_ERR(dev) ? PTR_ERR(dev) : 0;
} else { } else {
dev_dbg(&spi->dev, "no minor number available!\n"); dev_dbg(&spi->dev, "no minor number available!\n");
status = -ENODEV; status = -ENODEV;
} }
if (status == 0) { if (status == 0) {
set_bit(minor, minors); set_bit(minor, minors);
dev_set_drvdata(&spi->dev, spidev); spi_set_drvdata(spi, spidev);
list_add(&spidev->device_entry, &device_list); list_add(&spidev->device_entry, &device_list);
} }
mutex_unlock(&device_list_lock); mutex_unlock(&device_list_lock);
...@@ -596,19 +598,21 @@ static int spidev_probe(struct spi_device *spi) ...@@ -596,19 +598,21 @@ static int spidev_probe(struct spi_device *spi)
static int spidev_remove(struct spi_device *spi) static int spidev_remove(struct spi_device *spi)
{ {
struct spidev_data *spidev = dev_get_drvdata(&spi->dev); struct spidev_data *spidev = spi_get_drvdata(spi);
/* make sure ops on existing fds can abort cleanly */ /* make sure ops on existing fds can abort cleanly */
spin_lock_irq(&spidev->spi_lock); spin_lock_irq(&spidev->spi_lock);
spidev->spi = NULL; spidev->spi = NULL;
spi_set_drvdata(spi, NULL);
spin_unlock_irq(&spidev->spi_lock); spin_unlock_irq(&spidev->spi_lock);
/* prevent new opens */ /* prevent new opens */
mutex_lock(&device_list_lock); mutex_lock(&device_list_lock);
list_del(&spidev->device_entry); list_del(&spidev->device_entry);
dev_set_drvdata(&spi->dev, NULL); device_destroy(spidev_class, spidev->devt);
clear_bit(MINOR(spidev->dev.devt), minors); clear_bit(MINOR(spidev->devt), minors);
device_unregister(&spidev->dev); if (spidev->users == 0)
kfree(spidev);
mutex_unlock(&device_list_lock); mutex_unlock(&device_list_lock);
return 0; return 0;
...@@ -644,15 +648,15 @@ static int __init spidev_init(void) ...@@ -644,15 +648,15 @@ static int __init spidev_init(void)
if (status < 0) if (status < 0)
return status; return status;
status = class_register(&spidev_class); spidev_class = class_create(THIS_MODULE, "spidev");
if (status < 0) { if (IS_ERR(spidev_class)) {
unregister_chrdev(SPIDEV_MAJOR, spidev_spi.driver.name); unregister_chrdev(SPIDEV_MAJOR, spidev_spi.driver.name);
return status; return PTR_ERR(spidev_class);
} }
status = spi_register_driver(&spidev_spi); status = spi_register_driver(&spidev_spi);
if (status < 0) { if (status < 0) {
class_unregister(&spidev_class); class_destroy(spidev_class);
unregister_chrdev(SPIDEV_MAJOR, spidev_spi.driver.name); unregister_chrdev(SPIDEV_MAJOR, spidev_spi.driver.name);
} }
return status; return status;
...@@ -662,7 +666,7 @@ module_init(spidev_init); ...@@ -662,7 +666,7 @@ module_init(spidev_init);
static void __exit spidev_exit(void) static void __exit spidev_exit(void)
{ {
spi_unregister_driver(&spidev_spi); spi_unregister_driver(&spidev_spi);
class_unregister(&spidev_class); class_destroy(spidev_class);
unregister_chrdev(SPIDEV_MAJOR, spidev_spi.driver.name); unregister_chrdev(SPIDEV_MAJOR, spidev_spi.driver.name);
} }
module_exit(spidev_exit); module_exit(spidev_exit);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册