forge/linux-uconsole
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
linux-uconsole/drivers/base
History
Alex Williamson bdf2a0db17 driver core: Fix unbalanced device reference in drivers_probe 
commit bb34cb6bbd upstream.

bus_find_device_by_name() acquires a device reference which is never
released.  This results in an object leak, which on older kernels
results in failure to release all resources of PCI devices.  libvirt
uses drivers_probe to re-attach devices to the host after assignment
and is therefore a common trigger for this leak.

Example:

# cd /sys/bus/pci/
# dmesg -C
# echo 1 > devices/0000\:01\:00.0/sriov_numvfs
# echo 0 > devices/0000\:01\:00.0/sriov_numvfs
# dmesg | grep 01:10
 pci 0000:01:10.0: [8086:10ca] type 00 class 0x020000
 kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_add_internal: parent: '0000:00:01.0', set: 'devices'
 kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_uevent_env
 kobject: '0000:01:10.0' (ffff8801d79cd0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0'
 kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_uevent_env
 kobject: '0000:01:10.0' (ffff8801d79cd0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0'
 kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_uevent_env
 kobject: '0000:01:10.0' (ffff8801d79cd0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0'
 kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_cleanup, parent           (null)
 kobject: '0000:01:10.0' (ffff8801d79cd0a8): calling ktype release
 kobject: '0000:01:10.0': free name

[kobject freed as expected]

# dmesg -C
# echo 1 > devices/0000\:01\:00.0/sriov_numvfs
# echo 0000:01:10.0 > drivers_probe
# echo 0 > devices/0000\:01\:00.0/sriov_numvfs
# dmesg | grep 01:10
 pci 0000:01:10.0: [8086:10ca] type 00 class 0x020000
 kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_add_internal: parent: '0000:00:01.0', set: 'devices'
 kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_uevent_env
 kobject: '0000:01:10.0' (ffff8801d79ce0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0'
 kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_uevent_env
 kobject: '0000:01:10.0' (ffff8801d79ce0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0'
 kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_uevent_env
 kobject: '0000:01:10.0' (ffff8801d79ce0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0'

[no free]

Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-01-16 06:59:01 -08:00
..
power PM: Avoid calling kfree() under spinlock in dev_pm_put_subsys_data() 2013-05-12 14:04:40 +02:00
regmap regmap: fix NULL pointer dereference in _regmap_write/read 2014-10-30 09:35:10 -07:00
attribute_container.c drivers: base: Convert dev_printk(KERN_<LEVEL> to dev_<level>( 2012-10-30 17:38:43 -07:00
base.h driver/base: implement subsys_virtual_register() 2013-03-12 11:36:35 -07:00
bus.c driver core: Fix unbalanced device reference in drivers_probe 2015-01-16 06:59:01 -08:00
class.c driver-core: constify data for class_find_device() 2013-02-06 12:18:56 -08:00
core.c sysfs: driver core: Fix glue dir race condition by gdp_mutex 2014-11-14 08:48:01 -08:00
cpu.c numa, cpu hotplug: change links of CPU and node when changing node number by onlining CPU 2013-04-29 15:54:39 -07:00
dd.c drivercore: deferral race condition fix 2014-06-07 13:25:31 -07:00
devres.c Linux 3.9-rc3 2013-03-17 19:40:50 -07:00
devtmpfs.c driver core: handle user namespaces properly with the uid/gid devtmpfs change 2013-04-11 11:43:29 -07:00
dma-buf.c dma-buf: Add debugfs support 2013-05-01 16:36:22 +05:30
dma-coherent.c drivers: dma-coherent: Fix typo in dma_mmap_from_coherent documentation 2012-10-23 14:05:32 +02:00
dma-contiguous.c drivers: cma: represent physical addresses as phys_addr_t 2012-12-11 09:28:09 +01:00
dma-mapping.c [media] dma-mapping: fix dma_common_get_sgtable() conditional compilation 2012-11-27 09:42:31 -02:00
driver.c driver core: don't trigger uevent after failure 2012-07-17 10:40:23 -07:00
firmware.c
firmware_class.c firmware_class: make sure fw requests contain a name 2014-10-30 09:35:10 -07:00
hypervisor.c drivers/base: Add export.h for EXPORT_SYMBOL/THIS_MODULE as required. 2011-10-31 19:31:38 -04:00
init.c driver-core: implement 'sysdev' functionality for regular devices and buses 2011-12-14 14:29:38 -08:00
isa.c
Kconfig firmware: Make user-mode helper optional 2013-02-03 17:57:40 -08:00
Makefile drivers/pinctrl: grab default handles from device core 2013-01-23 16:39:51 +01:00
map.c
memory.c drivers/base/memory.c: fix show_mem_removable() to handle missing sections 2013-09-07 22:09:58 -07:00
module.c
node.c drivers/base/node.c: switch to register_hotmemory_notifier() 2013-04-29 15:54:36 -07:00
pinctrl.c drivers/pinctrl: grab default handles from device core 2013-01-23 16:39:51 +01:00
platform.c driver core: platform.c: fix checkpatch errors and warnings 2013-03-29 09:10:55 -07:00
soc.c mode_t whack-a-mole: ->is_visible() returns umode_t... 2012-05-29 23:28:42 -04:00
syscore.c PM: Reintroduce dropped call to check_wakeup_irqs 2011-07-11 10:51:49 +02:00
topology.c topology: Fix compilation warning when not in SMP 2014-06-07 13:25:29 -07:00
transport_class.c drivers/base: transport_class explicitly requires EXPORT_SYMBOL 2011-10-31 19:31:15 -04:00