Sorry Guys on disturbing you,
Will you guys please ACK, NACK or comment on this?
Thanks,
On Sun, 2012-07-29 at 23:31 +0545, Devendra Naga wrote:
> actually the driver does a request_threaded_irq and after this it calls
> lp8727_register_psy, and if it fails it doesn't free the irqs that it
> registered to
>
> Signed-off-by: Devendra Naga <[email protected]>
> ---
> drivers/power/lp8727_charger.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/power/lp8727_charger.c b/drivers/power/lp8727_charger.c
> index d8b7578..699f0ef 100644
> --- a/drivers/power/lp8727_charger.c
> +++ b/drivers/power/lp8727_charger.c
> @@ -454,11 +454,13 @@ static int lp8727_probe(struct i2c_client *cl, const struct i2c_device_id *id)
> ret = lp8727_register_psy(pchg);
> if (ret) {
> dev_err(pchg->dev, "power supplies register err: %d", ret);
> - goto error;
> + goto error_irq;
> }
>
> return 0;
>
> +error_irq:
> + free_irq(pchg->client->irq, pchg);
> error:
> kfree(pchg);
> return ret;
On Fri, Aug 10, 2012 at 10:05:55AM +0530, Devendra wrote:
> Sorry Guys on disturbing you,
>
> Will you guys please ACK, NACK or comment on this?
Technically, it looks OK. But the irq registration logic is sill broken,
and the hidden issue is much more serious.
1. lp8727_init_device() -> the function enables interrupts in hw;
2. lp8727_intr_config() -> the function requests interrupts, so CPU
is now able to process them;
3. lp8727_register_psy() -> the function allocates power supply
objects.
Now, the problem will arise if interrupt comes between "2." and
"3.", the interrupt service routine will cause NULL dereference.
So, what you really want to fix the driver is to reorder "2." and "3.",
and on error condition call lp8727_unregister_psy().
Thanks,
> On Sun, 2012-07-29 at 23:31 +0545, Devendra Naga wrote:
> > actually the driver does a request_threaded_irq and after this it calls
> > lp8727_register_psy, and if it fails it doesn't free the irqs that it
> > registered to
> >
> > Signed-off-by: Devendra Naga <[email protected]>
> > ---
> > drivers/power/lp8727_charger.c | 4 +++-
> > 1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/power/lp8727_charger.c b/drivers/power/lp8727_charger.c
> > index d8b7578..699f0ef 100644
> > --- a/drivers/power/lp8727_charger.c
> > +++ b/drivers/power/lp8727_charger.c
> > @@ -454,11 +454,13 @@ static int lp8727_probe(struct i2c_client *cl, const struct i2c_device_id *id)
> > ret = lp8727_register_psy(pchg);
> > if (ret) {
> > dev_err(pchg->dev, "power supplies register err: %d", ret);
> > - goto error;
> > + goto error_irq;
> > }
> >
> > return 0;
> >
> > +error_irq:
> > + free_irq(pchg->client->irq, pchg);
> > error:
> > kfree(pchg);
> > return ret;
Hi Anton,
On Mon, Aug 20, 2012 at 2:20 AM, Anton Vorontsov <[email protected]> wrote:
> On Fri, Aug 10, 2012 at 10:05:55AM +0530, Devendra wrote:
>> Sorry Guys on disturbing you,
>>
>> Will you guys please ACK, NACK or comment on this?
>
> Technically, it looks OK. But the irq registration logic is sill broken,
> and the hidden issue is much more serious.
>
> 1. lp8727_init_device() -> the function enables interrupts in hw;
> 2. lp8727_intr_config() -> the function requests interrupts, so CPU
> is now able to process them;
> 3. lp8727_register_psy() -> the function allocates power supply
> objects.
>
> Now, the problem will arise if interrupt comes between "2." and
> "3.", the interrupt service routine will cause NULL dereference.
>
> So, what you really want to fix the driver is to reorder "2." and "3.",
> and on error condition call lp8727_unregister_psy().
>
I think i need to learn more in order to touch this path. will give a try.
Thanks,
> Thanks,
>
>> On Sun, 2012-07-29 at 23:31 +0545, Devendra Naga wrote:
>> > actually the driver does a request_threaded_irq and after this it calls
>> > lp8727_register_psy, and if it fails it doesn't free the irqs that it
>> > registered to
>> >
>> > Signed-off-by: Devendra Naga <[email protected]>
>> > ---
>> > drivers/power/lp8727_charger.c | 4 +++-
>> > 1 file changed, 3 insertions(+), 1 deletion(-)
>> >
>> > diff --git a/drivers/power/lp8727_charger.c b/drivers/power/lp8727_charger.c
>> > index d8b7578..699f0ef 100644
>> > --- a/drivers/power/lp8727_charger.c
>> > +++ b/drivers/power/lp8727_charger.c
>> > @@ -454,11 +454,13 @@ static int lp8727_probe(struct i2c_client *cl, const struct i2c_device_id *id)
>> > ret = lp8727_register_psy(pchg);
>> > if (ret) {
>> > dev_err(pchg->dev, "power supplies register err: %d", ret);
>> > - goto error;
>> > + goto error_irq;
>> > }
>> >
>> > return 0;
>> >
>> > +error_irq:
>> > + free_irq(pchg->client->irq, pchg);
>> > error:
>> > kfree(pchg);
>> > return ret;
Best Regards,
Milo
> -----Original Message-----
> From: Devendra Naga [mailto:[email protected]]
> Sent: Friday, August 24, 2012 1:52 AM
> To: Anton Vorontsov
> Cc: David Woodhouse; [email protected]; Kim, Milo
> Subject: Re: [PATCH 1/2] lp8727_charger: free_irq when
> lp8727_register_psy fail
>
> Hi Anton,
>
> On Mon, Aug 20, 2012 at 2:20 AM, Anton Vorontsov
> <[email protected]> wrote:
> > On Fri, Aug 10, 2012 at 10:05:55AM +0530, Devendra wrote:
> >> Sorry Guys on disturbing you,
> >>
> >> Will you guys please ACK, NACK or comment on this?
> >
> > Technically, it looks OK. But the irq registration logic is sill
> broken,
> > and the hidden issue is much more serious.
> >
> > 1. lp8727_init_device() -> the function enables interrupts in hw;
> > 2. lp8727_intr_config() -> the function requests interrupts, so CPU
> > is now able to process them;
> > 3. lp8727_register_psy() -> the function allocates power supply
> > objects.
> >
> > Now, the problem will arise if interrupt comes between "2." and
> > "3.", the interrupt service routine will cause NULL dereference.
> >
> > So, what you really want to fix the driver is to reorder "2." and
> "3.",
> > and on error condition call lp8727_unregister_psy().
Please refer to the patch below.
[PATCH 2/8] lp8727_charger: cleanup _probe() and _remove()
Best Regards,
Milo