Commit 626b2dda authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'rpmsg-v5.17-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux

Pull rpmsg fixes from Bjorn Andersson:
 "The cdev cleanup in the rpmsg_char driver was not performed properly,
  resulting in unpredicable behaviour when the parent remote processor
  is stopped with any of the cdevs open by a client.

  Two patches transitions the implementation to use cdev_device_add()
  and cdev_del_device(), to capture the relationship between the two
  objects, and relocates the incorrectly placed cdev_del()"

* tag 'rpmsg-v5.17-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux:
  rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev
  rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev
parents 96b5590a 7a534ae8
...@@ -93,7 +93,7 @@ static int rpmsg_eptdev_destroy(struct device *dev, void *data) ...@@ -93,7 +93,7 @@ static int rpmsg_eptdev_destroy(struct device *dev, void *data)
/* wake up any blocked readers */ /* wake up any blocked readers */
wake_up_interruptible(&eptdev->readq); wake_up_interruptible(&eptdev->readq);
device_del(&eptdev->dev); cdev_device_del(&eptdev->cdev, &eptdev->dev);
put_device(&eptdev->dev); put_device(&eptdev->dev);
return 0; return 0;
...@@ -336,7 +336,6 @@ static void rpmsg_eptdev_release_device(struct device *dev) ...@@ -336,7 +336,6 @@ static void rpmsg_eptdev_release_device(struct device *dev)
ida_simple_remove(&rpmsg_ept_ida, dev->id); ida_simple_remove(&rpmsg_ept_ida, dev->id);
ida_simple_remove(&rpmsg_minor_ida, MINOR(eptdev->dev.devt)); ida_simple_remove(&rpmsg_minor_ida, MINOR(eptdev->dev.devt));
cdev_del(&eptdev->cdev);
kfree(eptdev); kfree(eptdev);
} }
...@@ -381,19 +380,13 @@ static int rpmsg_eptdev_create(struct rpmsg_ctrldev *ctrldev, ...@@ -381,19 +380,13 @@ static int rpmsg_eptdev_create(struct rpmsg_ctrldev *ctrldev,
dev->id = ret; dev->id = ret;
dev_set_name(dev, "rpmsg%d", ret); dev_set_name(dev, "rpmsg%d", ret);
ret = cdev_add(&eptdev->cdev, dev->devt, 1); ret = cdev_device_add(&eptdev->cdev, &eptdev->dev);
if (ret) if (ret)
goto free_ept_ida; goto free_ept_ida;
/* We can now rely on the release function for cleanup */ /* We can now rely on the release function for cleanup */
dev->release = rpmsg_eptdev_release_device; dev->release = rpmsg_eptdev_release_device;
ret = device_add(dev);
if (ret) {
dev_err(dev, "device_add failed: %d\n", ret);
put_device(dev);
}
return ret; return ret;
free_ept_ida: free_ept_ida:
...@@ -462,7 +455,6 @@ static void rpmsg_ctrldev_release_device(struct device *dev) ...@@ -462,7 +455,6 @@ static void rpmsg_ctrldev_release_device(struct device *dev)
ida_simple_remove(&rpmsg_ctrl_ida, dev->id); ida_simple_remove(&rpmsg_ctrl_ida, dev->id);
ida_simple_remove(&rpmsg_minor_ida, MINOR(dev->devt)); ida_simple_remove(&rpmsg_minor_ida, MINOR(dev->devt));
cdev_del(&ctrldev->cdev);
kfree(ctrldev); kfree(ctrldev);
} }
...@@ -497,19 +489,13 @@ static int rpmsg_chrdev_probe(struct rpmsg_device *rpdev) ...@@ -497,19 +489,13 @@ static int rpmsg_chrdev_probe(struct rpmsg_device *rpdev)
dev->id = ret; dev->id = ret;
dev_set_name(&ctrldev->dev, "rpmsg_ctrl%d", ret); dev_set_name(&ctrldev->dev, "rpmsg_ctrl%d", ret);
ret = cdev_add(&ctrldev->cdev, dev->devt, 1); ret = cdev_device_add(&ctrldev->cdev, &ctrldev->dev);
if (ret) if (ret)
goto free_ctrl_ida; goto free_ctrl_ida;
/* We can now rely on the release function for cleanup */ /* We can now rely on the release function for cleanup */
dev->release = rpmsg_ctrldev_release_device; dev->release = rpmsg_ctrldev_release_device;
ret = device_add(dev);
if (ret) {
dev_err(&rpdev->dev, "device_add failed: %d\n", ret);
put_device(dev);
}
dev_set_drvdata(&rpdev->dev, ctrldev); dev_set_drvdata(&rpdev->dev, ctrldev);
return ret; return ret;
...@@ -535,7 +521,7 @@ static void rpmsg_chrdev_remove(struct rpmsg_device *rpdev) ...@@ -535,7 +521,7 @@ static void rpmsg_chrdev_remove(struct rpmsg_device *rpdev)
if (ret) if (ret)
dev_warn(&rpdev->dev, "failed to nuke endpoints: %d\n", ret); dev_warn(&rpdev->dev, "failed to nuke endpoints: %d\n", ret);
device_del(&ctrldev->dev); cdev_device_del(&ctrldev->cdev, &ctrldev->dev);
put_device(&ctrldev->dev); put_device(&ctrldev->dev);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment