Patch "NFC: fix broken device allocation" has been added to the 3.18-stable tree
Subsystems (3)
This is a note to let you know that I've just added the patch titled
NFC: fix broken device allocation
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
nfc-fix-broken-device-allocation.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From
20777bc57c346b6994f465e0d8261a7fbf213a09Mon Sep 17 00:00:00 2001
From: Johan Hovold <[email protected]>
Date: Thu, 30 Mar 2017 12:15:35 +0200
Subject: NFC: fix broken device allocation
From: Johan Hovold <[email protected]>
commit 20777bc57c346b6994f465e0d8261a7fbf213a09 upstream.
Commit 7eda8b8e9677 ("NFC: Use IDR library to assing NFC devices IDs") moved device-id allocation and struct-device initialisation from nfc_allocate_device() to nfc_register_device().
This broke just about every nfc-device-registration error path, which continue to call nfc_free_device() that tries to put the device reference of the now uninitialised (but zeroed) struct device:
kobject: '(null)' (ce316420): is not initialized, yet kobject_put() is being called.
The late struct-device initialisation also meant that various work queues whose names are derived from the nfc device name were also misnamed:
421 root 0 SW< [(null)_nci_cmd_] 422 root 0 SW< [(null)_nci_rx_w] 423 root 0 SW< [(null)_nci_tx_w]
Move the id-allocation and struct-device initialisation back to nfc_allocate_device() and fix up the single call site which did not use nfc_free_device() in its error path.
--- net/nfc/core.c | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-)
net/nfc/core.c +18 -13
@@ -950,6 +950,8 @@ static void nfc_release(struct device *dkfree (se); } +ida_simple_remove (&nfc_index_ida, dev->idx); +kfree (dev); }
@@ -1024,6 +1026,7 @@ struct nfc_dev *nfc_allocate_device(stru int tx_headroom, int tx_tailroom) {struct nfc_dev *dev; +int rc;if (!ops->start_poll || !ops->stop_poll || !ops->activate_target || !ops->deactivate_target || !ops->im_transceive)
@@ -1036,6 +1039,15 @@ struct nfc_dev *nfc_allocate_device(struif (!dev)return NULL ; + rc =ida_simple_get (&nfc_index_ida,0 ,0 ,GFP_KERNEL ); +if (rc <0 ) + goto err_free_dev; + dev->idx = rc; + + dev->dev.class = &nfc_class; +dev_set_name (&dev->dev,"nfc%d" , dev->idx); +device_initialize (&dev->dev); + dev->ops = ops; dev->supported_protocols = supported_protocols; dev->tx_headroom = tx_headroom;
@@ -1058,6 +1070,11 @@ struct nfc_dev *nfc_allocate_device(stru }return dev; + +err_free_dev: +kfree (dev); + +return ERR_PTR (rc); }EXPORT_SYMBOL (nfc_allocate_device);
@@ -1072,14 +1089,6 @@ int nfc_register_device(struct nfc_dev *pr_debug ("dev_name=%s\n" ,dev_name (&dev->dev)); - dev->idx =ida_simple_get (&nfc_index_ida,0 ,0 ,GFP_KERNEL ); -if (dev->idx <0 ) -return dev->idx; - - dev->dev.class = &nfc_class; -dev_set_name (&dev->dev,"nfc%d" , dev->idx); -device_initialize (&dev->dev); -mutex_lock (&nfc_devlist_mutex); nfc_devlist_generation++; rc =device_add (&dev->dev);
@@ -1117,12 +1126,10 @@ EXPORT_SYMBOL(nfc_register_device);*/ void nfc_unregister_device (struct nfc_dev *dev) { -int rc, id; +int rc;pr_debug ("dev_name=%s\n" ,dev_name (&dev->dev)); - id = dev->idx; -if (dev->rfkill) {rfkill_unregister (dev->rfkill);rfkill_destroy (dev->rfkill);
@@ -1147,8 +1154,6 @@ void nfc_unregister_device(struct nfc_de nfc_devlist_generation++;device_del (&dev->dev);mutex_unlock (&nfc_devlist_mutex); - -ida_simple_remove (&nfc_index_ida, id); }EXPORT_SYMBOL (nfc_unregister_device);
Patches currently in stable-queue which might be from [email protected] are
queue-3.18/nfc-fix-broken-device-allocation.patch