| Message ID | 20210422201415.46378-1-tomasz.duszynski@octakon.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | iio: core: fix ioctl handlers removal | expand |
On Thu, Apr 22, 2021 at 11:26 PM Tomasz Duszynski <tomasz.duszynski@octakon.com> wrote: > > Currently ioctl handlers are removed twice. For the first time during > iio_device_unregister() then later on inside > iio_device_unregister_eventset() and iio_buffers_free_sysfs_and_mask(). > Double free leads to kernel panic. > > Fix this by not touching ioctl handlers list directly but rather > letting code responsible for registration call the matching cleanup > routine itself. > This change is missing this tag: Fixes: 8dedcc3eee3ac ("iio: core: centralize ioctl() calls to the main chardev") With that tag added: Acked-by: Alexandru Ardelean <ardeleanalex@gmail.com> Apologies for the breakage. Also, I wasn't sure if Jonathan or anyone else wanted to do this change. Thanks for the patch Alex > Signed-off-by: Tomasz Duszynski <tomasz.duszynski@octakon.com> > --- > drivers/iio/industrialio-core.c | 3 --- > 1 file changed, 3 deletions(-) > > diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c > index d92c58a94fe4..98944cfc7331 100644 > --- a/drivers/iio/industrialio-core.c > +++ b/drivers/iio/industrialio-core.c > @@ -1939,9 +1939,6 @@ void iio_device_unregister(struct iio_dev *indio_dev) > > indio_dev->info = NULL; > > - list_for_each_entry_safe(h, t, &iio_dev_opaque->ioctl_handlers, entry) > - list_del(&h->entry); > - > iio_device_wakeup_eventset(indio_dev); > iio_buffer_wakeup_poll(indio_dev); > > -- > 2.31.1 >
On Fri, Apr 23, 2021 at 10:17:42AM +0300, Alexandru Ardelean wrote: > On Thu, Apr 22, 2021 at 11:26 PM Tomasz Duszynski > <tomasz.duszynski@octakon.com> wrote: > > > > Currently ioctl handlers are removed twice. For the first time during > > iio_device_unregister() then later on inside > > iio_device_unregister_eventset() and iio_buffers_free_sysfs_and_mask(). > > Double free leads to kernel panic. > > > > Fix this by not touching ioctl handlers list directly but rather > > letting code responsible for registration call the matching cleanup > > routine itself. > > > > This change is missing this tag: > > Fixes: 8dedcc3eee3ac ("iio: core: centralize ioctl() calls to the main chardev") > > With that tag added: > Acked-by: Alexandru Ardelean <ardeleanalex@gmail.com> > > Apologies for the breakage. No worries. Will append you ack to v2 then. > Also, I wasn't sure if Jonathan or anyone else wanted to do this change. > > Thanks for the patch > Alex > > > Signed-off-by: Tomasz Duszynski <tomasz.duszynski@octakon.com> > > --- > > drivers/iio/industrialio-core.c | 3 --- > > 1 file changed, 3 deletions(-) > > > > diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c > > index d92c58a94fe4..98944cfc7331 100644 > > --- a/drivers/iio/industrialio-core.c > > +++ b/drivers/iio/industrialio-core.c > > @@ -1939,9 +1939,6 @@ void iio_device_unregister(struct iio_dev *indio_dev) > > > > indio_dev->info = NULL; > > > > - list_for_each_entry_safe(h, t, &iio_dev_opaque->ioctl_handlers, entry) > > - list_del(&h->entry); > > - > > iio_device_wakeup_eventset(indio_dev); > > iio_buffer_wakeup_poll(indio_dev); > > > > -- > > 2.31.1 > >
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c index d92c58a94fe4..98944cfc7331 100644 --- a/drivers/iio/industrialio-core.c +++ b/drivers/iio/industrialio-core.c @@ -1939,9 +1939,6 @@ void iio_device_unregister(struct iio_dev *indio_dev) indio_dev->info = NULL; - list_for_each_entry_safe(h, t, &iio_dev_opaque->ioctl_handlers, entry) - list_del(&h->entry); - iio_device_wakeup_eventset(indio_dev); iio_buffer_wakeup_poll(indio_dev);
Currently ioctl handlers are removed twice. For the first time during iio_device_unregister() then later on inside iio_device_unregister_eventset() and iio_buffers_free_sysfs_and_mask(). Double free leads to kernel panic. Fix this by not touching ioctl handlers list directly but rather letting code responsible for registration call the matching cleanup routine itself. Signed-off-by: Tomasz Duszynski <tomasz.duszynski@octakon.com> --- drivers/iio/industrialio-core.c | 3 --- 1 file changed, 3 deletions(-)