Commit 3e540b65 authored by Johan Hovold's avatar Johan Hovold Committed by Greg Kroah-Hartman

NFC: fix broken device allocation

commit 20777bc5 upstream.

Commit 7eda8b8e ("NFC: Use IDR library to assing NFC devices IDs")
moved device-id allocation and struct-device initialisation from
nfc_allocate_device() to nfc_register_device().

This broke just about every nfc-device-registration error path, which
continue to call nfc_free_device() that tries to put the device
reference of the now uninitialised (but zeroed) struct device:

kobject: '(null)' (ce316420): is not initialized, yet kobject_put() is being called.

The late struct-device initialisation also meant that various work
queues whose names are derived from the nfc device name were also
misnamed:

  421 root         0 SW<  [(null)_nci_cmd_]
  422 root         0 SW<  [(null)_nci_rx_w]
  423 root         0 SW<  [(null)_nci_tx_w]

Move the id-allocation and struct-device initialisation back to
nfc_allocate_device() and fix up the single call site which did not use
nfc_free_device() in its error path.

Fixes: 7eda8b8e ("NFC: Use IDR library to assing NFC devices IDs")
Cc: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
Signed-off-by: default avatarSamuel Ortiz <sameo@linux.intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent bf3d383a
...@@ -982,6 +982,8 @@ static void nfc_release(struct device *d) ...@@ -982,6 +982,8 @@ static void nfc_release(struct device *d)
kfree(se); kfree(se);
} }
ida_simple_remove(&nfc_index_ida, dev->idx);
kfree(dev); kfree(dev);
} }
...@@ -1056,6 +1058,7 @@ struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops, ...@@ -1056,6 +1058,7 @@ struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
int tx_headroom, int tx_tailroom) int tx_headroom, int tx_tailroom)
{ {
struct nfc_dev *dev; struct nfc_dev *dev;
int rc;
if (!ops->start_poll || !ops->stop_poll || !ops->activate_target || if (!ops->start_poll || !ops->stop_poll || !ops->activate_target ||
!ops->deactivate_target || !ops->im_transceive) !ops->deactivate_target || !ops->im_transceive)
...@@ -1068,6 +1071,15 @@ struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops, ...@@ -1068,6 +1071,15 @@ struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
if (!dev) if (!dev)
return NULL; return NULL;
rc = ida_simple_get(&nfc_index_ida, 0, 0, GFP_KERNEL);
if (rc < 0)
goto err_free_dev;
dev->idx = rc;
dev->dev.class = &nfc_class;
dev_set_name(&dev->dev, "nfc%d", dev->idx);
device_initialize(&dev->dev);
dev->ops = ops; dev->ops = ops;
dev->supported_protocols = supported_protocols; dev->supported_protocols = supported_protocols;
dev->tx_headroom = tx_headroom; dev->tx_headroom = tx_headroom;
...@@ -1090,6 +1102,11 @@ struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops, ...@@ -1090,6 +1102,11 @@ struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
} }
return dev; return dev;
err_free_dev:
kfree(dev);
return ERR_PTR(rc);
} }
EXPORT_SYMBOL(nfc_allocate_device); EXPORT_SYMBOL(nfc_allocate_device);
...@@ -1104,14 +1121,6 @@ int nfc_register_device(struct nfc_dev *dev) ...@@ -1104,14 +1121,6 @@ int nfc_register_device(struct nfc_dev *dev)
pr_debug("dev_name=%s\n", dev_name(&dev->dev)); pr_debug("dev_name=%s\n", dev_name(&dev->dev));
dev->idx = ida_simple_get(&nfc_index_ida, 0, 0, GFP_KERNEL);
if (dev->idx < 0)
return dev->idx;
dev->dev.class = &nfc_class;
dev_set_name(&dev->dev, "nfc%d", dev->idx);
device_initialize(&dev->dev);
mutex_lock(&nfc_devlist_mutex); mutex_lock(&nfc_devlist_mutex);
nfc_devlist_generation++; nfc_devlist_generation++;
rc = device_add(&dev->dev); rc = device_add(&dev->dev);
...@@ -1149,12 +1158,10 @@ EXPORT_SYMBOL(nfc_register_device); ...@@ -1149,12 +1158,10 @@ EXPORT_SYMBOL(nfc_register_device);
*/ */
void nfc_unregister_device(struct nfc_dev *dev) void nfc_unregister_device(struct nfc_dev *dev)
{ {
int rc, id; int rc;
pr_debug("dev_name=%s\n", dev_name(&dev->dev)); pr_debug("dev_name=%s\n", dev_name(&dev->dev));
id = dev->idx;
if (dev->rfkill) { if (dev->rfkill) {
rfkill_unregister(dev->rfkill); rfkill_unregister(dev->rfkill);
rfkill_destroy(dev->rfkill); rfkill_destroy(dev->rfkill);
...@@ -1179,8 +1186,6 @@ void nfc_unregister_device(struct nfc_dev *dev) ...@@ -1179,8 +1186,6 @@ void nfc_unregister_device(struct nfc_dev *dev)
nfc_devlist_generation++; nfc_devlist_generation++;
device_del(&dev->dev); device_del(&dev->dev);
mutex_unlock(&nfc_devlist_mutex); mutex_unlock(&nfc_devlist_mutex);
ida_simple_remove(&nfc_index_ida, id);
} }
EXPORT_SYMBOL(nfc_unregister_device); EXPORT_SYMBOL(nfc_unregister_device);
......
...@@ -1173,8 +1173,7 @@ struct nci_dev *nci_allocate_device(struct nci_ops *ops, ...@@ -1173,8 +1173,7 @@ struct nci_dev *nci_allocate_device(struct nci_ops *ops,
return ndev; return ndev;
free_nfc: free_nfc:
kfree(ndev->nfc_dev); nfc_free_device(ndev->nfc_dev);
free_nci: free_nci:
kfree(ndev); kfree(ndev);
return NULL; return NULL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment