diff options
| author | Konstantin Belousov <kib@FreeBSD.org> | 2021-03-30 08:44:19 +0000 |
|---|---|---|
| committer | Konstantin Belousov <kib@FreeBSD.org> | 2021-04-06 00:38:29 +0000 |
| commit | 7f9867f8c65b1b3e590dba4dc432a4bc8cf01f68 (patch) | |
| tree | d7432de25a51fa43b52d21e6fca1a5b55e47e004 | |
| parent | 28b482e2baf43cdd30e8b9bd090e6d9f405cf4b3 (diff) | |
| download | src-7f9867f8c65b1b3e590dba4dc432a4bc8cf01f68.tar.gz src-7f9867f8c65b1b3e590dba4dc432a4bc8cf01f68.zip | |
linuxkpi: do not destroy/free embedded linux cdevs
They have their own lifetime managed by the containing objects.
Premature and unexpected free causes corruption.
Reviewed by: hselasky
Sponsored by: Mellanox Technologies/NVidia Networking
MFC after: 1 week
| -rw-r--r-- | sys/compat/linuxkpi/common/src/linux_compat.c | 13 | ||||
| -rw-r--r-- | sys/compat/linuxkpi/common/src/linux_compat.c.orig | 6 |
2 files changed, 13 insertions, 6 deletions
diff --git a/sys/compat/linuxkpi/common/src/linux_compat.c b/sys/compat/linuxkpi/common/src/linux_compat.c index 0731859e7a53..71ea7e0844dc 100644 --- a/sys/compat/linuxkpi/common/src/linux_compat.c +++ b/sys/compat/linuxkpi/common/src/linux_compat.c @@ -2199,8 +2199,8 @@ linux_completion_done(struct completion *c) static void linux_cdev_deref(struct linux_cdev *ldev) { - - if (refcount_release(&ldev->refs)) + if (refcount_release(&ldev->refs) && + ldev->kobj.ktype == &linux_cdev_ktype) kfree(ldev); } @@ -2220,12 +2220,17 @@ linux_cdev_release(struct kobject *kobj) static void linux_cdev_static_release(struct kobject *kobj) { + struct cdev *cdev; struct linux_cdev *ldev; struct kobject *parent; ldev = container_of(kobj, struct linux_cdev, kobj); parent = kobj->parent; - linux_destroy_dev(ldev); + cdev = ldev->cdev; + if (cdev != NULL) { + destroy_dev(cdev); + ldev->cdev = NULL; + } kobject_put(parent); } @@ -2237,6 +2242,8 @@ linux_destroy_dev(struct linux_cdev *ldev) return; MPASS((ldev->siref & LDEV_SI_DTR) == 0); + MPASS(ldev->kobj.ktype == &linux_cdev_ktype); + atomic_set_int(&ldev->siref, LDEV_SI_DTR); while ((atomic_load_int(&ldev->siref) & ~LDEV_SI_DTR) != 0) pause("ldevdtr", hz / 4); diff --git a/sys/compat/linuxkpi/common/src/linux_compat.c.orig b/sys/compat/linuxkpi/common/src/linux_compat.c.orig index b7a7ba8b4f18..0731859e7a53 100644 --- a/sys/compat/linuxkpi/common/src/linux_compat.c.orig +++ b/sys/compat/linuxkpi/common/src/linux_compat.c.orig @@ -2220,12 +2220,12 @@ linux_cdev_release(struct kobject *kobj) static void linux_cdev_static_release(struct kobject *kobj) { - struct linux_cdev *cdev; + struct linux_cdev *ldev; struct kobject *parent; - cdev = container_of(kobj, struct linux_cdev, kobj); + ldev = container_of(kobj, struct linux_cdev, kobj); parent = kobj->parent; - linux_destroy_dev(cdev); + linux_destroy_dev(ldev); kobject_put(parent); } |