• Tyrel Datwyler's avatar
    powerpc/pseries: Fix of_node_put() underflow during DLPAR remove · 7c95e5af
    Tyrel Datwyler authored
    commit 68baf692 upstream.
    
    Historically struct device_node references were tracked using a kref embedded as
    a struct field. Commit 75b57ecf ("of: Make device nodes kobjects so they
    show up in sysfs") (Mar 2014) refactored device_nodes to be kobjects such that
    the device tree could by more simply exposed to userspace using sysfs.
    
    Commit 0829f6d1 ("of: device_node kobject lifecycle fixes") (Mar 2014)
    followed up these changes to better control the kobject lifecycle and in
    particular the referecne counting via of_node_get(), of_node_put(), and
    of_node_init().
    
    A result of this second commit was that it introduced an of_node_put() call when
    a dynamic node is detached, in of_node_remove(), that removes the initial kobj
    reference created by of_node_init().
    
    Traditionally as the original dynamic device node user the pseries code had
    assumed responsibilty for releasing this final reference in its platform
    specific DLPAR detach code.
    
    This patch fixes a refcount underflow introduced by commit 0829f6d1, and
    recently exposed by the upstreaming of the recount API.
    
    Messages like the following are no longer seen in the kernel log with this
    patch following DLPAR remove operations of cpus and pci devices.
    
      rpadlpar_io: slot PHB 72 removed
      refcount_t: underflow; use-after-free.
      ------------[ cut here ]------------
      WARNING: CPU: 5 PID: 3335 at lib/refcount.c:128 refcount_sub_and_test+0xf4/0x110
    
    Fixes: 0829f6d1 ("of: device_node kobject lifecycle fixes")
    Signed-off-by: default avatarTyrel Datwyler <tyreld@linux.vnet.ibm.com>
    [mpe: Make change log commit references more verbose]
    Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    7c95e5af
dlpar.c 10.8 KB