If device_add() is called with a device which does not have dev->p set
up, then device_private_init() is called. If that succeeds, then the
error variable is set to 0. Now if the dev_name(dev) check further
down fails, then device_add() correctly terminates, but returns 0.
That of course lets the driver progress. If later another driver uses
this half set up device as parent then device_add() of the child
device explodes and renders sysfs completely unusable.
Set the error to -EINVAL if dev_name() check fails.
Signed-off-by: Thomas Gleixner <[email protected]>
Cc: Greg Kroah-Hartman <[email protected]>
Cc: Kay Sievers <[email protected]>
---
drivers/base/core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
Index: linux-2.6-tip/drivers/base/core.c
===================================================================
--- linux-2.6-tip.orig/drivers/base/core.c
+++ linux-2.6-tip/drivers/base/core.c
@@ -898,8 +898,10 @@ int device_add(struct device *dev)
dev->init_name = NULL;
}
- if (!dev_name(dev))
+ if (!dev_name(dev)) {
+ error = -EINVAL;
goto name_error;
+ }
pr_debug("device: '%s': %s\n", dev_name(dev), __func__);
On Thu, Dec 10, 2009 at 07:32:49PM -0000, Thomas Gleixner wrote:
> If device_add() is called with a device which does not have dev->p set
> up, then device_private_init() is called. If that succeeds, then the
> error variable is set to 0. Now if the dev_name(dev) check further
> down fails, then device_add() correctly terminates, but returns 0.
> That of course lets the driver progress. If later another driver uses
> this half set up device as parent then device_add() of the child
> device explodes and renders sysfs completely unusable.
>
> Set the error to -EINVAL if dev_name() check fails.
That's a good catch, thanks.
Is anything currently triggering this? Or did you just find it by
reading the code?
thanks,
greg k-h
On Thu, 10 Dec 2009, Greg KH wrote:
> On Thu, Dec 10, 2009 at 07:32:49PM -0000, Thomas Gleixner wrote:
> > If device_add() is called with a device which does not have dev->p set
> > up, then device_private_init() is called. If that succeeds, then the
> > error variable is set to 0. Now if the dev_name(dev) check further
> > down fails, then device_add() correctly terminates, but returns 0.
> > That of course lets the driver progress. If later another driver uses
> > this half set up device as parent then device_add() of the child
> > device explodes and renders sysfs completely unusable.
> >
> > Set the error to -EINVAL if dev_name() check fails.
>
> That's a good catch, thanks.
>
> Is anything currently triggering this? Or did you just find it by
> reading the code?
Hans-Juergen had a buggy vendor driver where init_name was not
initialized. So the driver probing succeeded and after that a
depending driver crashed somewhere in device_add().
Thanks,
tglx
On Thu, Dec 10, 2009 at 10:01:10PM +0100, Thomas Gleixner wrote:
> On Thu, 10 Dec 2009, Greg KH wrote:
> > On Thu, Dec 10, 2009 at 07:32:49PM -0000, Thomas Gleixner wrote:
> > > If device_add() is called with a device which does not have dev->p set
> > > up, then device_private_init() is called. If that succeeds, then the
> > > error variable is set to 0. Now if the dev_name(dev) check further
> > > down fails, then device_add() correctly terminates, but returns 0.
> > > That of course lets the driver progress. If later another driver uses
> > > this half set up device as parent then device_add() of the child
> > > device explodes and renders sysfs completely unusable.
> > >
> > > Set the error to -EINVAL if dev_name() check fails.
> >
> > That's a good catch, thanks.
> >
> > Is anything currently triggering this? Or did you just find it by
> > reading the code?
>
> Hans-Juergen had a buggy vendor driver where init_name was not
> initialized. So the driver probing succeeded and after that a
> depending driver crashed somewhere in device_add().
Ick, bad code :(
Good to know it's not a problem with in-tree drivers, so I don't have to
add this to the -stable trees.
thanks,
greg k-h
On Thu, Dec 10, 2009 at 10:01:10PM +0100, Thomas Gleixner wrote:
> On Thu, 10 Dec 2009, Greg KH wrote:
> > On Thu, Dec 10, 2009 at 07:32:49PM -0000, Thomas Gleixner wrote:
> > > If device_add() is called with a device which does not have dev->p set
> > > up, then device_private_init() is called. If that succeeds, then the
> > > error variable is set to 0. Now if the dev_name(dev) check further
> > > down fails, then device_add() correctly terminates, but returns 0.
> > > That of course lets the driver progress. If later another driver uses
> > > this half set up device as parent then device_add() of the child
> > > device explodes and renders sysfs completely unusable.
> > >
> > > Set the error to -EINVAL if dev_name() check fails.
> >
> > That's a good catch, thanks.
> >
> > Is anything currently triggering this? Or did you just find it by
> > reading the code?
>
> Hans-Juergen had a buggy vendor driver where init_name was not
> initialized. So the driver probing succeeded and after that a
> depending driver crashed somewhere in device_add().
That was one of these USB UDC drivers. It falsely reported OK at probe time
and crashed when modprobing a gadget driver. Complete hang of the machine
could be achieved by just doing "ls /sys"...
Of course, it's the driver's fault not to set init_name, but it's a bit
annoying if such mistakes freeze your machine instead of simply producing
an error that helps fixing the driver.
Thanks,
Hans