2007-01-08 16:06:46

by Alan Stern

[permalink] [raw]
Subject: [PATCH] Driver core: fix refcounting bug

This patch (as832) fixes a newly-introduced bug in the driver core.
When a kobject is assigned to a kset, it must acquire a reference to
the kset.

Signed-off-by: Alan Stern <[email protected]>

---

The bug was introduced in Kay's "unify /sys/class and /sys/bus at
/sys/subsystem" patch.

I left the assignment of class_dev->kobj.parent as it was, although it is
not needed. The following call to kobject_add() will end up doing the
same thing.

Alan Stern

P.S.: Tracking down refcounting bugs is a real pain! I spent an entire
afternoon on this one... :-(


Index: usb-2.6/drivers/base/class.c
===================================================================
--- usb-2.6.orig/drivers/base/class.c
+++ usb-2.6/drivers/base/class.c
@@ -648,7 +648,7 @@ int class_device_add(struct class_device
class_dev->kobj.parent = &parent_class_dev->kobj;
else {
/* assign parent kset for uevent hook */
- class_dev->kobj.kset = &parent_class->devices_dir;
+ class_dev->kobj.kset = kset_get(&parent_class->devices_dir);
/* the device directory in /sys/subsystem/<name>/devices */
class_dev->kobj.parent = &parent_class->devices_dir.kobj;
}


2007-01-09 04:24:07

by Andrew Morton

[permalink] [raw]
Subject: Re: [PATCH] Driver core: fix refcounting bug

On Mon, 8 Jan 2007 11:06:44 -0500 (EST)
Alan Stern <[email protected]> wrote:

> This patch (as832) fixes a newly-introduced bug in the driver core.
> When a kobject is assigned to a kset, it must acquire a reference to
> the kset.
>
> Signed-off-by: Alan Stern <[email protected]>
>
> ---
>
> The bug was introduced in Kay's "unify /sys/class and /sys/bus at
> /sys/subsystem" patch.
>
> I left the assignment of class_dev->kobj.parent as it was, although it is
> not needed. The following call to kobject_add() will end up doing the
> same thing.
>
> Alan Stern
>
> P.S.: Tracking down refcounting bugs is a real pain! I spent an entire
> afternoon on this one... :-(
>
>
> Index: usb-2.6/drivers/base/class.c
> ===================================================================
> --- usb-2.6.orig/drivers/base/class.c
> +++ usb-2.6/drivers/base/class.c
> @@ -648,7 +648,7 @@ int class_device_add(struct class_device
> class_dev->kobj.parent = &parent_class_dev->kobj;
> else {
> /* assign parent kset for uevent hook */
> - class_dev->kobj.kset = &parent_class->devices_dir;
> + class_dev->kobj.kset = kset_get(&parent_class->devices_dir);
> /* the device directory in /sys/subsystem/<name>/devices */
> class_dev->kobj.parent = &parent_class->devices_dir.kobj;
> }

OK, I give up. What kernel is this against?

More importantly: does 2.6.20-rc4 need fixing?

2007-01-09 07:13:58

by Greg KH

[permalink] [raw]
Subject: Re: [PATCH] Driver core: fix refcounting bug

On Mon, Jan 08, 2007 at 08:23:59PM -0800, Andrew Morton wrote:
> On Mon, 8 Jan 2007 11:06:44 -0500 (EST)
> Alan Stern <[email protected]> wrote:
>
> > This patch (as832) fixes a newly-introduced bug in the driver core.
> > When a kobject is assigned to a kset, it must acquire a reference to
> > the kset.
> >
> > Signed-off-by: Alan Stern <[email protected]>
> >
> > ---
> >
> > The bug was introduced in Kay's "unify /sys/class and /sys/bus at
> > /sys/subsystem" patch.
> >
> > I left the assignment of class_dev->kobj.parent as it was, although it is
> > not needed. The following call to kobject_add() will end up doing the
> > same thing.
> >
> > Alan Stern
> >
> > P.S.: Tracking down refcounting bugs is a real pain! I spent an entire
> > afternoon on this one... :-(
> >
> >
> > Index: usb-2.6/drivers/base/class.c
> > ===================================================================
> > --- usb-2.6.orig/drivers/base/class.c
> > +++ usb-2.6/drivers/base/class.c
> > @@ -648,7 +648,7 @@ int class_device_add(struct class_device
> > class_dev->kobj.parent = &parent_class_dev->kobj;
> > else {
> > /* assign parent kset for uevent hook */
> > - class_dev->kobj.kset = &parent_class->devices_dir;
> > + class_dev->kobj.kset = kset_get(&parent_class->devices_dir);
> > /* the device directory in /sys/subsystem/<name>/devices */
> > class_dev->kobj.parent = &parent_class->devices_dir.kobj;
> > }
>
> OK, I give up. What kernel is this against?

I think this is against my private tree, with the "driver-class" patches
that are not in -mm (for good reason at this point in time.) Right
Alan?

thanks,

greg k-h

2007-01-09 14:53:44

by Alan Stern

[permalink] [raw]
Subject: Re: [PATCH] Driver core: fix refcounting bug

On Mon, 8 Jan 2007, Greg KH wrote:

> On Mon, Jan 08, 2007 at 08:23:59PM -0800, Andrew Morton wrote:
> > On Mon, 8 Jan 2007 11:06:44 -0500 (EST)
> > Alan Stern <[email protected]> wrote:
> >
> > > This patch (as832) fixes a newly-introduced bug in the driver core.
> > > When a kobject is assigned to a kset, it must acquire a reference to
> > > the kset.

> > OK, I give up. What kernel is this against?
>
> I think this is against my private tree, with the "driver-class" patches
> that are not in -mm (for good reason at this point in time.) Right
> Alan?

That's exactly right. And it's also why I didn't CC: Andrew on the
original patch submission.

Alan Stern

2007-01-17 00:46:33

by Greg KH

[permalink] [raw]
Subject: Re: [PATCH] Driver core: fix refcounting bug

On Mon, Jan 08, 2007 at 11:06:44AM -0500, Alan Stern wrote:
> This patch (as832) fixes a newly-introduced bug in the driver core.
> When a kobject is assigned to a kset, it must acquire a reference to
> the kset.
>
> Signed-off-by: Alan Stern <[email protected]>
>
> ---
>
> The bug was introduced in Kay's "unify /sys/class and /sys/bus at
> /sys/subsystem" patch.
>
> I left the assignment of class_dev->kobj.parent as it was, although it is
> not needed. The following call to kobject_add() will end up doing the
> same thing.
>
> Alan Stern
>
> P.S.: Tracking down refcounting bugs is a real pain! I spent an entire
> afternoon on this one... :-(

Thanks, I've merged your patch with the one from Kay so we don't
introduce a bug along the way.

greg k-h