On Tue, 4 Jun 2024 12:50:09 -0300
Jason Gunthorpe <jgg@xxxxxxxxxx> wrote:
> On Tue, Jun 04, 2024 at 12:32:19PM +0300, Leon Romanovsky wrote:
> > > +static struct fwctl_device *
> > > +_alloc_device(struct device *parent, const struct fwctl_ops *ops, size_t size)
> > > +{
> > > + struct fwctl_device *fwctl __free(kfree) = kzalloc(size, GFP_KERNEL);
> > > +
> > > + if (!fwctl)
> > > + return NULL;
> >
> > <...>
> >
> > > +/* Drivers use the fwctl_alloc_device() wrapper */
> > > +struct fwctl_device *_fwctl_alloc_device(struct device *parent,
> > > + const struct fwctl_ops *ops,
> > > + size_t size)
> > > +{
> > > + struct fwctl_device *fwctl __free(fwctl) =
> > > + _alloc_device(parent, ops, size);
> >
> > I'm not a big fan of cleanup.h pattern as it hides important to me
> > information about memory object lifetime and by "solving" one class of
> > problems it creates another one.
>
> I'm trying it here. One of the most common bugs I end up fixing is
> error unwind and cleanup.h has successfully removed all of it. Let's
> find out, others thought it was a good idea to add the infrastructure.
>
> One thing that seems clear in my work here is that you should not use
> cleanup.h if you don't have simple memory lifetime, like the above
> case where the memory is freed if the function fails.
>
> > You didn't check if fwctl is NULL before using it.
>
> Oops, yes
>
> > > + int devnum;
> > > +
> > > + devnum = ida_alloc_max(&fwctl_ida, FWCTL_MAX_DEVICES - 1, GFP_KERNEL);
> > > + if (devnum < 0)
> > > + return NULL;
> > > + fwctl->dev.devt = fwctl_dev + devnum;
> > > +
> > > + cdev_init(&fwctl->cdev, &fwctl_fops);
> > > + fwctl->cdev.owner = THIS_MODULE;
> > > +
> > > + if (dev_set_name(&fwctl->dev, "fwctl%d", fwctl->dev.devt - fwctl_dev))
> >
> > Did you miss ida_free() here?
>
> No, the put_device() does it in the release function. The __free
> always calls fwctl_put()/put_device() on failure, and within all
> functions except _alloc_device() the put_device() is the correct way
> to free this memory.
The conditional handling of the ida having been allocated or not is a bit ugly
as I think it's just papering over this corner case.
Can fwctl_dev and devnum both be zero? In practice no, but is that guaranteed
for all time? Maybe...
We got some kick back from Linus a while back in CXL and the outcome was
a few more helpers rather than too much cleverness in the use of __free.
Trick for this is often to define a small function that allocates both the
ida and the device. With in that micro function handle the one error path
or if you only have two things to do, you can use __free() for the allocation.
Something like
static struct fwctl_device *__alloc_device_and_devt(sizet_t size)
{
struct fw_ctl_device *fwctl;
int devnum;
fwctl = ida_alloc_max(&fwct ...);
if (!fwctl)
return NULL;
devnum = ida_alloc_max(&fwct ...);
if (devnum < 0) {
kfree(fwctl);
return NULL;
}
fwctl->dev.devt = fwctl_Ddev + devnum;
reutrn fwctl;
}
Then call device_initialize() on the returned structure ->dev as you know
you ida and the containing structure are both in a state where the put_device()
call doesn't need conditions on 'how initialized' it is.
Still, maybe the ugly is fine.
>
> Thanks,
> Jason
>
>
