There is a possible race condition when a device
is added while another device with the same parent
, with ref count of one, is deleted.
CPU0 CPU1
device_add() device_del()
get_device_parent() put_device(parent);
kobj = kobject_get(k); kobject_put()
kref_put()
refcount=0
refcount is 0
WARNS it was 0 but
return kobj frees kobj
uses the freed parent kobj
The race condition exists because kref_put() and the
release function is not atomic.
Using kobject_get_unless_zero() instead of
kobject_get() in get_device_parent() will prevent
this race condition.
Signed-off-by: eun.taik.lee <eun.taik....@samsung.com>
---
drivers/base/core.c | 2 +-
include/linux/kobject.h | 2 ++
lib/kobject.c | 2 +-
3 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 07304a3..ec2f211 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -761,7 +761,7 @@ static struct kobject *get_device_parent(struct device
*dev,
spin_lock(&dev->class->p->glue_dirs.list_lock);
list_for_each_entry(k, &dev->class->p->glue_dirs.list, entry)
if (k->parent == parent_kobj) {
- kobj = kobject_get(k);
+ kobj = kobject_get_unless_zero(k);
break;
}
spin_unlock(&dev->class->p->glue_dirs.list_lock);
diff --git a/include/linux/kobject.h b/include/linux/kobject.h
index 2d61b90..3032744 100644
--- a/include/linux/kobject.h
+++ b/include/linux/kobject.h
@@ -107,6 +107,8 @@ extern int __must_check kobject_rename(struct kobject *,
const char *new_name);
extern int __must_check kobject_move(struct kobject *, struct kobject *);
extern struct kobject *kobject_get(struct kobject *kobj);
+extern struct kobject * __must_check kobject_get_unless_zero(
+ struct kobject *kobj);
extern void kobject_put(struct kobject *kobj);
extern const void *kobject_namespace(struct kobject *kobj);
diff --git a/lib/kobject.c b/lib/kobject.c
index 03d4ab3..ff0ce681 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -581,7 +581,7 @@ struct kobject *kobject_get(struct kobject *kobj)
return kobj;
}
-static struct kobject * __must_check kobject_get_unless_zero(struct kobject
*kobj)
+struct kobject * __must_check kobject_get_unless_zero(struct kobject *kobj)
{
if (!kref_get_unless_zero(&kobj->kref))
kobj =
NULL;N�����r��y����b�X��ǧv�^�){.n�+����{����zX����ܨ}���Ơz�&j:+v�������zZ+��+zf���h���~����i���z� �w���?�����&�)ߢf��^jǫy�m��@A�a���
0��h���i
