linux/drivers/mmc/core
Linus Walleij 1c87f73578 mmc: block: Fix bug when removing RPMB chardev
I forgot to account for the fact that the device core holds a
reference to a device added with device_initialize() that need
to be released with a corresponding put_device() to reach a 0
refcount at the end of the lifecycle.

This led to a NULL pointer reference when freeing the device
when e.g. unbidning the host device in sysfs.

Fix this and use the device .release() callback to free the
IDA and free:ing the memory used by the RPMB device.

Before this patch:

/sys/bus/amba/drivers/mmci-pl18x$ echo 80114000.sdi4_per2 > unbind
[   29.797332] mmc3: card 0001 removed
[   29.810791] Unable to handle kernel NULL pointer dereference at
               virtual address 00000050
[   29.818878] pgd = de70c000
[   29.821624] [00000050] *pgd=1e70a831, *pte=00000000, *ppte=00000000
[   29.827911] Internal error: Oops: 17 [#1] PREEMPT SMP ARM
[   29.833282] Modules linked in:
[   29.836334] CPU: 1 PID: 154 Comm: sh Not tainted
               4.14.0-rc3-00039-g83318e309566-dirty #736
[   29.844604] Hardware name: ST-Ericsson Ux5x0 platform (Device Tree Support)
[   29.851562] task: de572700 task.stack: de742000
[   29.856079] PC is at kernfs_find_ns+0x8/0x100
[   29.860443] LR is at kernfs_find_and_get_ns+0x30/0x48

After this patch:

/sys/bus/amba/drivers/mmci-pl18x$ echo 80005000.sdi4_per2 > unbind
[   20.623382] mmc3: card 0001 removed

Fixes: 97548575be ("mmc: block: Convert RPMB to a character device")
Reported-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2017-10-30 11:44:49 +01:00
..
block.c mmc: block: Fix bug when removing RPMB chardev 2017-10-30 11:44:49 +01:00
block.h mmc: block: stop passing around pointless return values 2017-02-13 13:20:40 +01:00
bus.c mmc: core: Move public functions from host.h to private headers 2017-02-13 13:20:25 +01:00
bus.h mmc: core: Move public functions from card.h to private headers 2017-02-13 13:20:24 +01:00
card.h mmc: core: change quirks.c to be a header file 2017-02-15 11:34:26 +01:00
core.c mmc: core: Turn off CQE before sending commands 2017-08-30 15:03:33 +02:00
core.h mmc: core: Move mmc_start_areq() declaration 2017-08-30 15:03:53 +02:00
debugfs.c mmc: debugfs: Move block debugfs into block module 2017-08-30 15:03:39 +02:00
host.c mmc: core: Add mmc_retune_hold_now() 2017-08-30 14:02:01 +02:00
host.h mmc: core: Add mmc_retune_hold_now() 2017-08-30 14:02:01 +02:00
Kconfig mmc: core: Delete bounce buffer Kconfig option 2017-06-20 10:30:17 +02:00
Makefile mmc: core: change quirks.c to be a header file 2017-02-15 11:34:26 +01:00
mmc_ops.c mmc: ops: export mmc_get_status() 2017-08-30 15:03:39 +02:00
mmc_ops.h mmc: core: Re-factor code for sending CID 2017-06-20 10:30:45 +02:00
mmc_test.c mmc: test: reduce stack usage in mmc_test_nonblock_transfer 2017-08-30 15:03:37 +02:00
mmc.c mmc: core: add driver strength selection when selecting hs400es 2017-10-02 10:11:22 +02:00
pwrseq_emmc.c mmc: core: Don't do eMMC HW reset when resuming the eMMC card 2017-06-20 10:30:10 +02:00
pwrseq_sd8787.c mmc: pwrseq: add support for Marvell SD8787 chip 2017-02-13 13:20:33 +01:00
pwrseq_simple.c mmc: pwrseq_simple: Parse DTS for the power-off-delay-us property 2017-05-23 14:17:36 +02:00
pwrseq.c mmc: pwrseq: Add reset callback to the struct mmc_pwrseq_ops 2017-06-20 10:30:09 +02:00
pwrseq.h mmc: pwrseq: Add reset callback to the struct mmc_pwrseq_ops 2017-06-20 10:30:09 +02:00
queue.c mmc: block: Delete mmc_access_rpmb() 2017-10-30 11:40:10 +01:00
queue.h mmc: block: Delete mmc_access_rpmb() 2017-10-30 11:40:10 +01:00
quirks.h mmc: core: add mmc prefix for blk_fixups 2017-02-15 11:34:27 +01:00
sd_ops.c mmc: core: add proper be32 annotation 2017-04-24 21:42:19 +02:00
sd_ops.h mmc: core: add proper be32 annotation 2017-04-24 21:42:19 +02:00
sd.c mmc: core: correct taac parameter according to the specification 2017-08-30 14:01:46 +02:00
sd.h mmc: core: First step in cleaning up private mmc header files 2017-02-13 13:20:20 +01:00
sdio_bus.c mmc: sdio: fix alignment issue in struct sdio_func 2017-04-18 19:18:07 +02:00
sdio_bus.h mmc: core: First step in cleaning up private mmc header files 2017-02-13 13:20:20 +01:00
sdio_cis.c mmc: core: remove BUG_ONs from sdio 2016-12-05 10:31:08 +01:00
sdio_cis.h mmc: core: First step in cleaning up private mmc header files 2017-02-13 13:20:20 +01:00
sdio_io.c mmc: core: simplify return code 2017-04-24 21:41:24 +02:00
sdio_irq.c mmc: sdio: Add API to manage SDIO IRQs from a workqueue 2017-06-20 10:30:11 +02:00
sdio_ops.c mmc: sdio: improve mmc_io_rw_extended 2017-04-24 21:41:42 +02:00
sdio_ops.h mmc: sdio: Add API to manage SDIO IRQs from a workqueue 2017-06-20 10:30:11 +02:00
sdio_uart.c mmc: block: Move files to core 2016-12-12 16:30:05 +01:00
sdio.c mmc: sdio: Keep card runtime resumed while adding function devices 2017-06-20 10:30:39 +02:00
slot-gpio.c mmc: slot-gpio: Add support to enable irq wake on cd_irq 2017-06-20 10:30:49 +02:00
slot-gpio.h mmc: core: First step in cleaning up private mmc header files 2017-02-13 13:20:20 +01:00