When synclink_gt driver open failed, it doesn't release resources. Compile
tested only.
Fixes: d4c63b7c7450 ("synclink_gt fix module reference")
Fixes: 705b6c7b34f2 ("[PATCH] new driver synclink_gt")
Signed-off-by: Zhengchao Shao <[email protected]>
---
drivers/tty/synclink_gt.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
index 25e9befdda3a..4dea52486410 100644
--- a/drivers/tty/synclink_gt.c
+++ b/drivers/tty/synclink_gt.c
@@ -1441,14 +1441,15 @@ static int hdlcdev_open(struct net_device *dev)
/* generic HDLC layer open processing */
rc = hdlc_open(dev);
if (rc)
- return rc;
+ goto err_open;
/* arbitrate between network and tty opens */
spin_lock_irqsave(&info->netlock, flags);
if (info->port.count != 0 || info->netcount != 0) {
DBGINFO(("%s hdlc_open busy\n", dev->name));
spin_unlock_irqrestore(&info->netlock, flags);
- return -EBUSY;
+ rc = -EBUSY;
+ goto err_open_busy;
}
info->netcount=1;
spin_unlock_irqrestore(&info->netlock, flags);
@@ -1458,7 +1459,7 @@ static int hdlcdev_open(struct net_device *dev)
spin_lock_irqsave(&info->netlock, flags);
info->netcount=0;
spin_unlock_irqrestore(&info->netlock, flags);
- return rc;
+ goto err_open_busy;
}
/* assert RTS and DTR, apply hardware settings */
@@ -1478,6 +1479,12 @@ static int hdlcdev_open(struct net_device *dev)
else
netif_carrier_off(dev);
return 0;
+
+err_open_busy:
+ hdlc_close(dev);
+err_open:
+ module_put(THIS_MODULE);
+ return rc;
}
/**
--
2.17.1
On 14. 11. 22, 2:07, Zhengchao Shao wrote:
> When synclink_gt driver open failed, it doesn't release resources.
But hdlc_close() does. Now, you call it (apart from the TTY layer) too.
> Compile tested only.
Hmm, NACK.
> Fixes: d4c63b7c7450 ("synclink_gt fix module reference")
> Fixes: 705b6c7b34f2 ("[PATCH] new driver synclink_gt")
> Signed-off-by: Zhengchao Shao <[email protected]>
> ---
> drivers/tty/synclink_gt.c | 13 ++++++++++---
> 1 file changed, 10 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
> index 25e9befdda3a..4dea52486410 100644
> --- a/drivers/tty/synclink_gt.c
> +++ b/drivers/tty/synclink_gt.c
> @@ -1441,14 +1441,15 @@ static int hdlcdev_open(struct net_device *dev)
> /* generic HDLC layer open processing */
> rc = hdlc_open(dev);
> if (rc)
> - return rc;
> + goto err_open;
>
> /* arbitrate between network and tty opens */
> spin_lock_irqsave(&info->netlock, flags);
> if (info->port.count != 0 || info->netcount != 0) {
> DBGINFO(("%s hdlc_open busy\n", dev->name));
> spin_unlock_irqrestore(&info->netlock, flags);
> - return -EBUSY;
> + rc = -EBUSY;
> + goto err_open_busy;
> }
> info->netcount=1;
> spin_unlock_irqrestore(&info->netlock, flags);
> @@ -1458,7 +1459,7 @@ static int hdlcdev_open(struct net_device *dev)
> spin_lock_irqsave(&info->netlock, flags);
> info->netcount=0;
> spin_unlock_irqrestore(&info->netlock, flags);
> - return rc;
> + goto err_open_busy;
> }
>
> /* assert RTS and DTR, apply hardware settings */
> @@ -1478,6 +1479,12 @@ static int hdlcdev_open(struct net_device *dev)
> else
> netif_carrier_off(dev);
> return 0;
> +
> +err_open_busy:
> + hdlc_close(dev);
> +err_open:
> + module_put(THIS_MODULE);
> + return rc;
> }
>
> /**
--
js
suse labs
On Mon, Nov 14, 2022 at 09:07:34AM +0800, Zhengchao Shao wrote:
> When synclink_gt driver open failed, it doesn't release resources. Compile
> tested only.
How was this found? Please always provide the proper required
information about stuff like this as our documentation requires.
thanks,
greg k-h
This patch identifies two problems in the error path of hdlcdev_open():
1. module_get/put pairing
2. hdlc_open/close pairing
The module_get/put calls are not necessary. The synclink_gt driver is pinned on hardware enumeration which happens before registering as a generic hdlc device. I think this is cruft leftover from ancient code. The only other generic hdlc (network) driver I still see doing it is farsync.c.
The best solution is removing the module_get/put calls and balancing hdlc_open() with hdlc_close() in the error path of hdlcdev_open(). I will submit a patch to do so after I’ve had a chance to test it.
> On Nov 13, 2022, at 5:07 PM, Zhengchao Shao <[email protected]> wrote:
>
> When synclink_gt driver open failed, it doesn't release resources. Compile
> tested only.
>
> Fixes: d4c63b7c7450 ("synclink_gt fix module reference")
> Fixes: 705b6c7b34f2 ("[PATCH] new driver synclink_gt")
> Signed-off-by: Zhengchao Shao <[email protected]>
> ---
> drivers/tty/synclink_gt.c | 13 ++++++++++---
> 1 file changed, 10 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
> index 25e9befdda3a..4dea52486410 100644
> --- a/drivers/tty/synclink_gt.c
> +++ b/drivers/tty/synclink_gt.c
> @@ -1441,14 +1441,15 @@ static int hdlcdev_open(struct net_device *dev)
> /* generic HDLC layer open processing */
> rc = hdlc_open(dev);
> if (rc)
> - return rc;
> + goto err_open;
>
> /* arbitrate between network and tty opens */
> spin_lock_irqsave(&info->netlock, flags);
> if (info->port.count != 0 || info->netcount != 0) {
> DBGINFO(("%s hdlc_open busy\n", dev->name));
> spin_unlock_irqrestore(&info->netlock, flags);
> - return -EBUSY;
> + rc = -EBUSY;
> + goto err_open_busy;
> }
> info->netcount=1;
> spin_unlock_irqrestore(&info->netlock, flags);
> @@ -1458,7 +1459,7 @@ static int hdlcdev_open(struct net_device *dev)
> spin_lock_irqsave(&info->netlock, flags);
> info->netcount=0;
> spin_unlock_irqrestore(&info->netlock, flags);
> - return rc;
> + goto err_open_busy;
> }
>
> /* assert RTS and DTR, apply hardware settings */
> @@ -1478,6 +1479,12 @@ static int hdlcdev_open(struct net_device *dev)
> else
> netif_carrier_off(dev);
> return 0;
> +
> +err_open_busy:
> + hdlc_close(dev);
> +err_open:
> + module_put(THIS_MODULE);
> + return rc;
> }
>
> /**
> --
> 2.17.1
>
hdlcdev_open() in synclink_gt.c did not fully unwind actions
in the error path. The use of try_module_get()/module_put() is
unnecessary, potentially hazardous and is removed. The synclink_gt
driver is already pinned any point the net device is registered, a
requirement for calling this entry point.
The call hdlc_open() to init the generic HDLC layer is moved to
after driver level init/checks and proper rollback of previous
actions is added. This is a more sensible ordering as the
most common error paths are at the driver level and the driver
level rollbacks require less processing than
hdlc_open()/hdlc_close().
This has been tested with supported hardware.
Suggested-by: Zhengchao Shao <[email protected]>
Signed-off-by: Paul Fulghum <[email protected]>
diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
index 25e9befdda3a..72b76cdde534 100644
--- a/drivers/tty/synclink_gt.c
+++ b/drivers/tty/synclink_gt.c
@@ -1433,16 +1433,8 @@ static int hdlcdev_open(struct net_device *dev)
int rc;
unsigned long flags;
- if (!try_module_get(THIS_MODULE))
- return -EBUSY;
-
DBGINFO(("%s hdlcdev_open\n", dev->name));
- /* generic HDLC layer open processing */
- rc = hdlc_open(dev);
- if (rc)
- return rc;
-
/* arbitrate between network and tty opens */
spin_lock_irqsave(&info->netlock, flags);
if (info->port.count != 0 || info->netcount != 0) {
@@ -1461,6 +1453,16 @@ static int hdlcdev_open(struct net_device *dev)
return rc;
}
+ /* generic HDLC layer open processing */
+ rc = hdlc_open(dev);
+ if (rc) {
+ shutdown(info);
+ spin_lock_irqsave(&info->netlock, flags);
+ info->netcount = 0;
+ spin_unlock_irqrestore(&info->netlock, flags);
+ return rc;
+ }
+
/* assert RTS and DTR, apply hardware settings */
info->signals |= SerialSignal_RTS | SerialSignal_DTR;
program_hw(info);
@@ -1506,7 +1508,6 @@ static int hdlcdev_close(struct net_device *dev)
info->netcount=0;
spin_unlock_irqrestore(&info->netlock, flags);
- module_put(THIS_MODULE);
return 0;
}
On Tue, Nov 15, 2022 at 10:21:14AM -0800, Paul Fulghum wrote:
> hdlcdev_open() in synclink_gt.c did not fully unwind actions
> in the error path. The use of try_module_get()/module_put() is unnecessary,
> potentially hazardous and is removed. The synclink_gt driver is already
> pinned any point the net device is registered, a requirement for calling
> this entry point.
>
> The call hdlc_open() to init the generic HDLC layer is moved to
> after driver level init/checks and proper rollback of previous
> actions is added. This is a more sensible ordering as the
> most common error paths are at the driver level and the driver
> level rollbacks require less processing than
> hdlc_open()/hdlc_close().
>
> This has been tested with supported hardware.
>
> Suggested-by: Zhengchao Shao <[email protected]>
> Signed-off-by: Paul Fulghum <[email protected]>
>
> diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
> index 25e9befdda3a..72b76cdde534 100644
> --- a/drivers/tty/synclink_gt.c
> +++ b/drivers/tty/synclink_gt.c
> @@ -1433,16 +1433,8 @@ static int hdlcdev_open(struct net_device *dev)
> int rc;
> unsigned long flags;
>
> - if (!try_module_get(THIS_MODULE))
> - return -EBUSY;
> -
> DBGINFO(("%s hdlcdev_open\n", dev->name));
>
> - /* generic HDLC layer open processing */
> - rc = hdlc_open(dev);
> - if (rc)
> - return rc;
> -
> /* arbitrate between network and tty opens */
> spin_lock_irqsave(&info->netlock, flags);
> if (info->port.count != 0 || info->netcount != 0) {
> @@ -1461,6 +1453,16 @@ static int hdlcdev_open(struct net_device *dev)
> return rc;
> }
>
> + /* generic HDLC layer open processing */
> + rc = hdlc_open(dev);
> + if (rc) {
> + shutdown(info);
> + spin_lock_irqsave(&info->netlock, flags);
> + info->netcount = 0;
> + spin_unlock_irqrestore(&info->netlock, flags);
> + return rc;
> + }
> +
> /* assert RTS and DTR, apply hardware settings */
> info->signals |= SerialSignal_RTS | SerialSignal_DTR;
> program_hw(info);
> @@ -1506,7 +1508,6 @@ static int hdlcdev_close(struct net_device *dev)
> info->netcount=0;
> spin_unlock_irqrestore(&info->netlock, flags);
>
> - module_put(THIS_MODULE);
> return 0;
> }
>
Hi,
This is the friendly patch-bot of Greg Kroah-Hartman. You have sent him
a patch that has triggered this response. He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created. Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.
You are receiving this message because of the following common error(s)
as indicated below:
- Your patch is malformed (tabs converted to spaces, linewrapped, etc.)
and can not be applied. Please read the file,
Documentation/email-clients.txt in order to fix this.
- This looks like a new version of a previously submitted patch, but you
did not list below the --- line any changes from the previous version.
Please read the section entitled "The canonical patch format" in the
kernel file, Documentation/SubmittingPatches for what needs to be done
here to properly describe this.
If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.
thanks,
greg k-h's patch email bot
synclink_gt.c:hdlcdev_open() does not properly
unwind actions in error path.
Unwound action 1: try_module_get(THIS_MODULE)
Change d4c63b7c7450 added try_module_get()/module_put()
to stop WARN_ON if modprobe -r removes synclink_gt while net
device is open. This is same as drivers/wan/farsync.c.
Other generic HDLC hardware drivers do not do this.
On unload, synclink_gt calls
drivers/wan/hdlc.c:unregister_hdlc_device()
which calls down to
net/sched/sch_generic.c:dev_shutdown() triggering
WARN_ON(timer_pending(&dev->watchdog_timer));
if net device is open.
try_module_get/module_put, a disfavored pattern, is replaced
by a call to dev_close() for open net device
before calling unregister_hdlc_device() when driver unloads.
This pevents WARN_ON.
Unwound action 2: drivers/wan/hdlc.c:hdlc_open()
This is moved to after driver level init/checks with proper
rollback of previous actions. This is a more sensible
ordering as the most common error paths are at the driver level
and the driver level rollbacks require less processing than
hdlc_open()/hdlc_close().
Fixes: d4c63b7c7450 ("synclink_gt fix module reference")
Fixes: 705b6c7b34f2 ("[PATCH] new driver synclink_gt")
Suggested-by: Zhengchao Shao <[email protected]>
Tested-by: Paul Fulghum <[email protected]>
Signed-off-by: Paul Fulghum <[email protected]>
---
V1 -> V2: improve description, add dev_close call
drivers/tty/synclink_gt.c | 25 ++++++++++++++++---------
1 file changed, 16 insertions(+), 9 deletions(-)
diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
index 25e9befdda3a..5921703f7228 100644
--- a/drivers/tty/synclink_gt.c
+++ b/drivers/tty/synclink_gt.c
@@ -70,6 +70,7 @@
#include <linux/bitops.h>
#include <linux/workqueue.h>
#include <linux/hdlc.h>
+#include <linux/inetdevice.h>
#include <linux/synclink.h>
#include <asm/io.h>
@@ -1433,16 +1434,8 @@ static int hdlcdev_open(struct net_device *dev)
int rc;
unsigned long flags;
- if (!try_module_get(THIS_MODULE))
- return -EBUSY;
-
DBGINFO(("%s hdlcdev_open\n", dev->name));
- /* generic HDLC layer open processing */
- rc = hdlc_open(dev);
- if (rc)
- return rc;
-
/* arbitrate between network and tty opens */
spin_lock_irqsave(&info->netlock, flags);
if (info->port.count != 0 || info->netcount != 0) {
@@ -1461,6 +1454,16 @@ static int hdlcdev_open(struct net_device *dev)
return rc;
}
+ /* generic HDLC layer open processing */
+ rc = hdlc_open(dev);
+ if (rc) {
+ shutdown(info);
+ spin_lock_irqsave(&info->netlock, flags);
+ info->netcount = 0;
+ spin_unlock_irqrestore(&info->netlock, flags);
+ return rc;
+ }
+
/* assert RTS and DTR, apply hardware settings */
info->signals |= SerialSignal_RTS | SerialSignal_DTR;
program_hw(info);
@@ -1506,7 +1509,6 @@ static int hdlcdev_close(struct net_device *dev)
info->netcount=0;
spin_unlock_irqrestore(&info->netlock, flags);
- module_put(THIS_MODULE);
return 0;
}
@@ -1742,6 +1744,11 @@ static void hdlcdev_exit(struct slgt_info *info)
{
if (!info->netdev)
return;
+ if (info->netcount) {
+ rtnl_lock();
+ dev_close(info->netdev);
+ rtnl_unlock();
+ }
unregister_hdlc_device(info->netdev);
free_netdev(info->netdev);
info->netdev = NULL;
--
2.34.1