Commit 626b2dda authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'rpmsg-v5.17-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux 

Pull rpmsg fixes from Bjorn Andersson:
 "The cdev cleanup in the rpmsg_char driver was not performed properly,
  resulting in unpredicable behaviour when the parent remote processor
  is stopped with any of the cdevs open by a client.

  Two patches transitions the implementation to use cdev_device_add()
  and cdev_del_device(), to capture the relationship between the two
  objects, and relocates the incorrectly placed cdev_del()"

* tag 'rpmsg-v5.17-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux:
  rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev
  rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev
parents 96b5590a 7a534ae8

drivers/rpmsg/rpmsg_char.c

+4 −18
Original line number Diff line number Diff line
@@ -93,7 +93,7 @@ static int rpmsg_eptdev_destroy(struct device *dev, void *data) 
	/* wake up any blocked readers */

	wake_up_interruptible(&eptdev->readq);



	device_del(&eptdev->dev);

	cdev_device_del(&eptdev->cdev, &eptdev->dev);

	put_device(&eptdev->dev);



	return 0;
@@ -336,7 +336,6 @@ static void rpmsg_eptdev_release_device(struct device *dev) 


	ida_simple_remove(&rpmsg_ept_ida, dev->id);

	ida_simple_remove(&rpmsg_minor_ida, MINOR(eptdev->dev.devt));

	cdev_del(&eptdev->cdev);

	kfree(eptdev);

}
@@ -381,19 +380,13 @@ static int rpmsg_eptdev_create(struct rpmsg_ctrldev *ctrldev, 
	dev->id = ret;

	dev_set_name(dev, "rpmsg%d", ret);



	ret = cdev_add(&eptdev->cdev, dev->devt, 1);

	ret = cdev_device_add(&eptdev->cdev, &eptdev->dev);

	if (ret)

		goto free_ept_ida;



	/* We can now rely on the release function for cleanup */

	dev->release = rpmsg_eptdev_release_device;



	ret = device_add(dev);

	if (ret) {

		dev_err(dev, "device_add failed: %d\n", ret);

		put_device(dev);

	}



	return ret;



free_ept_ida:
@@ -462,7 +455,6 @@ static void rpmsg_ctrldev_release_device(struct device *dev) 


	ida_simple_remove(&rpmsg_ctrl_ida, dev->id);

	ida_simple_remove(&rpmsg_minor_ida, MINOR(dev->devt));

	cdev_del(&ctrldev->cdev);

	kfree(ctrldev);

}
@@ -497,19 +489,13 @@ static int rpmsg_chrdev_probe(struct rpmsg_device *rpdev) 
	dev->id = ret;

	dev_set_name(&ctrldev->dev, "rpmsg_ctrl%d", ret);



	ret = cdev_add(&ctrldev->cdev, dev->devt, 1);

	ret = cdev_device_add(&ctrldev->cdev, &ctrldev->dev);

	if (ret)

		goto free_ctrl_ida;



	/* We can now rely on the release function for cleanup */

	dev->release = rpmsg_ctrldev_release_device;



	ret = device_add(dev);

	if (ret) {

		dev_err(&rpdev->dev, "device_add failed: %d\n", ret);

		put_device(dev);

	}



	dev_set_drvdata(&rpdev->dev, ctrldev);



	return ret;
@@ -535,7 +521,7 @@ static void rpmsg_chrdev_remove(struct rpmsg_device *rpdev) 
	if (ret)

		dev_warn(&rpdev->dev, "failed to nuke endpoints: %d\n", ret);



	device_del(&ctrldev->dev);

	cdev_device_del(&ctrldev->cdev, &ctrldev->dev);

	put_device(&ctrldev->dev);

}