Message-id: <564EE0D9.9030608@samsung.com>
Date: Fri, 20 Nov 2015 09:59:05 +0100
From: Jacek Anaszewski <j.anaszewski@samsung.com>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130804
 Thunderbird/17.0.8
MIME-version: 1.0
To: Milo Kim <milo.kim@ti.com>
Cc: linux-leds@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] leds: turn off the LED and wait for completion on
 unregistering LED class device
References: <1448006580-4232-1-git-send-email-milo.kim@ti.com>
In-reply-to: <1448006580-4232-1-git-send-email-milo.kim@ti.com>
Content-type: text/plain; charset=ISO-8859-1; format=flowed
Content-transfer-encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 2520
Lines: 78

Hi Milo,

Thanks for catching this, applied.

Best Regards,
Jacek Anaszewski

On 11/20/2015 09:03 AM, Milo Kim wrote:
> Workqueue, 'set_brightness_work' is used for scheduling brightness control.
> This workqueue is canceled when the LED class device is unregistered.
> Currently, LED subsystem handles like below.
>
>    cancel_work_sync(&led_cdev->set_brightness_work)
>    led_set_brightness(led_cdev, LED_OFF)
>
> However, this could be a problem.
> Workqueue is going to be canceled but LED device needs to be off.
> The worst case is null pointer access due to scheduling a workqueue.
>
> LED module is loaded.
>    LED driver private data is allocated by using devm_zalloc().
>
> LED module is unloaded.
>    led_classdev_unregister() is called.
>      cancel_work_sync()
>        led_set_brightness(led_cdev, LED_OFF)
>          schedule_work() if LED driver uses brightness_set_blocking()
>          In the meantime, driver private data will be freed.
>
>          ..scheduling..
>
>          brightness_set_blocking() callback is invoked.
>            For the brightness control, LED driver tries to access private
>            data but resource is removed!
>
> To avoid this problem, LED subsystem should turn off the brightness first
> and wait for completion.
>
>    led_set_brightness(led_cdev, LED_OFF)
>    flush_work(&led_cdev->set_brightness_work)
>
> It guarantees that LED driver turns off the brightness prior to
> resource management.
>
> Cc: linux-leds@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> Signed-off-by: Milo Kim <milo.kim@ti.com>
> ---
>   drivers/leds/led-class.c | 5 +++--
>   1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
> index d946991..14139c3 100644
> --- a/drivers/leds/led-class.c
> +++ b/drivers/leds/led-class.c
> @@ -245,12 +245,13 @@ void led_classdev_unregister(struct led_classdev *led_cdev)
>   	up_write(&led_cdev->trigger_lock);
>   #endif
>
> -	cancel_work_sync(&led_cdev->set_brightness_work);
> -
>   	/* Stop blinking */
>   	led_stop_software_blink(led_cdev);
> +
>   	led_set_brightness(led_cdev, LED_OFF);
>
> +	flush_work(&led_cdev->set_brightness_work);
> +
>   	device_unregister(led_cdev->dev);
>
>   	down_write(&leds_list_lock);
>

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/