55c91fedd0
vm_dev has a separate lifecycle because it has a 'struct device'
embedded. Thus, having a release callback for it is correct.
Allocating the vm_dev struct with devres totally breaks this protection,
though. Instead of waiting for the vm_dev release callback, the memory
is freed when the platform_device is removed. Resulting in a
use-after-free when finally the callback is to be called.
To easily see the problem, compile the kernel with
CONFIG_DEBUG_KOBJECT_RELEASE and unbind with sysfs.
The fix is easy, don't use devres in this case.
Found during my research about object lifetime problems.
Fixes:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| virtio_anchor.c | ||
| virtio_balloon.c | ||
| virtio_dma_buf.c | ||
| virtio_input.c | ||
| virtio_mem.c | ||
| virtio_mmio.c | ||
| virtio_pci_common.c | ||
| virtio_pci_common.h | ||
| virtio_pci_legacy_dev.c | ||
| virtio_pci_legacy.c | ||
| virtio_pci_modern_dev.c | ||
| virtio_pci_modern.c | ||
| virtio_ring.c | ||
| virtio_vdpa.c | ||
| virtio.c | ||