Re: [PATCH] Driver core: fix race in dev_driver_string

[Alan Stern]

On Fri, 4 Dec 2009, Oliver Neukum wrote:

> > > 1. am I supposed to get a reference just so that I can use dev_err?
> > 
> > No, you should already have a reference on the device when doing the
> > call, right?
> 
> No, why? Consider this:
> 
> int write(...)
> {
> 	...
> 	mutex_lock(&instance->lock);
> 	if (instance->disconnected) {
> 		dev_dbg(instance->dev,"writing to disconnected device"); 
> 		rv = -ENODEV;
> 	} else {
> 		res = usb_submit_urb(...);
> 		rv = res < 0 ? -EIO : count;
> 	}
> 	mutex_unlock(&instance->lock);
> 	return rv;
> }
> 
> void disconnect(...)
> {
> 	...
> 	mutex_lock(&instance->lock);
> 	instance->disconnected = 1;
> 	usb_kill_urb(...);
> 	usb_kill_urb(...);
> 	mutex_unlock(&instance->lock);
> }
> 
> This would be perfectly valid code without any references taken save
> for the pesky dev_dbg()

Whoever calls write() must possess a valid reference.  Otherwise 
instance might already be deallocated when write() starts, causing an 
oops well before the call to dev_dbg().

Typically the driver would take a reference during open() and drop it 
during close().

Alan Stern

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/