On Mon, 8 Mar 2021 09:29:39 +0200
Alexandru Ardelean <ardeleanalex@xxxxxxxxx> wrote:
> On Sun, Mar 7, 2021 at 8:55 PM Alexandru Ardelean
> <ardeleanalex@xxxxxxxxx> wrote:
> >
> > Thanks to Lars for finding this.
> > The free of the 'attached_buffers' array should be done as late as
> > possible. This change moves it to iio_buffers_put(), which looks like
> > the best place for it, since it takes place right before the IIO device
> > data is free'd.
> > The free of this array will be handled by calling iio_device_free().
> > The iio_buffers_put() function is renamed to iio_device_detach_buffers()
> > since the role of this function changes a bit.
> >
> > It looks like this issue was ocurring on the error path of
> > iio_buffers_alloc_sysfs_and_mask() and in
> > iio_buffers_free_sysfs_and_mask()
> >
> > Added a comment in the doc-header of iio_device_attach_buffer() to
> > mention how this will be free'd in case anyone is reading the code
> > and becoming confused about it.
> >
> > Fixes: 36f3118c414d ("iio: buffer: introduce support for attaching more IIO buffers")
> > Reported-by: Lars-Peter Clausen <lars@xxxxxxxxxx>
> > Signed-off-by: Alexandru Ardelean <ardeleanalex@xxxxxxxxx>
Applied to the togreg branch of iio.git and pushed out as testing for
the autobuilders to poke at it.
Thanks,
Jonathan
> > ---
>
> Forgot the changelog.
>
> Changelog v1 -> v2:
> * rename iio_buffers_put() -> iio_device_detach_buffers()
>
> > drivers/iio/iio_core.h | 4 ++--
> > drivers/iio/industrialio-buffer.c | 9 +++++----
> > drivers/iio/industrialio-core.c | 2 +-
> > 3 files changed, 8 insertions(+), 7 deletions(-)
> >
> > diff --git a/drivers/iio/iio_core.h b/drivers/iio/iio_core.h
> > index 062fe16c6c49..8f4a9b264962 100644
> > --- a/drivers/iio/iio_core.h
> > +++ b/drivers/iio/iio_core.h
> > @@ -77,7 +77,7 @@ void iio_buffers_free_sysfs_and_mask(struct iio_dev *indio_dev);
> >
> > void iio_disable_all_buffers(struct iio_dev *indio_dev);
> > void iio_buffer_wakeup_poll(struct iio_dev *indio_dev);
> > -void iio_buffers_put(struct iio_dev *indio_dev);
> > +void iio_device_detach_buffers(struct iio_dev *indio_dev);
> >
> > #else
> >
> > @@ -93,7 +93,7 @@ static inline void iio_buffers_free_sysfs_and_mask(struct iio_dev *indio_dev) {}
> >
> > static inline void iio_disable_all_buffers(struct iio_dev *indio_dev) {}
> > static inline void iio_buffer_wakeup_poll(struct iio_dev *indio_dev) {}
> > -static inline void iio_buffers_put(struct iio_dev *indio_dev) {}
> > +static inline void iio_device_detach_buffers(struct iio_dev *indio_dev) {}
> >
> > #endif
> >
> > diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
> > index 1a415e97174e..1ff7f731b044 100644
> > --- a/drivers/iio/industrialio-buffer.c
> > +++ b/drivers/iio/industrialio-buffer.c
> > @@ -326,7 +326,7 @@ void iio_buffer_init(struct iio_buffer *buffer)
> > }
> > EXPORT_SYMBOL(iio_buffer_init);
> >
> > -void iio_buffers_put(struct iio_dev *indio_dev)
> > +void iio_device_detach_buffers(struct iio_dev *indio_dev)
> > {
> > struct iio_dev_opaque *iio_dev_opaque = to_iio_dev_opaque(indio_dev);
> > struct iio_buffer *buffer;
> > @@ -336,6 +336,8 @@ void iio_buffers_put(struct iio_dev *indio_dev)
> > buffer = iio_dev_opaque->attached_buffers[i];
> > iio_buffer_put(buffer);
> > }
> > +
> > + kfree(iio_dev_opaque->attached_buffers);
> > }
> >
> > static ssize_t iio_show_scan_index(struct device *dev,
> > @@ -1764,7 +1766,6 @@ int iio_buffers_alloc_sysfs_and_mask(struct iio_dev *indio_dev)
> > buffer = iio_dev_opaque->attached_buffers[unwind_idx];
> > __iio_buffer_free_sysfs_and_mask(buffer);
> > }
> > - kfree(iio_dev_opaque->attached_buffers);
> > return ret;
> > }
> >
> > @@ -1786,8 +1787,6 @@ void iio_buffers_free_sysfs_and_mask(struct iio_dev *indio_dev)
> > buffer = iio_dev_opaque->attached_buffers[i];
> > __iio_buffer_free_sysfs_and_mask(buffer);
> > }
> > -
> > - kfree(iio_dev_opaque->attached_buffers);
> > }
> >
> > /**
> > @@ -2062,6 +2061,8 @@ static int iio_buffer_mmap(struct file *filep, struct vm_area_struct *vma)
> > * This function attaches a buffer to a IIO device. The buffer stays attached to
> > * the device until the device is freed. For legacy reasons, the first attached
> > * buffer will also be assigned to 'indio_dev->buffer'.
> > + * The array allocated here, will be free'd via the iio_device_detach_buffers()
> > + * call which is handled by the iio_device_free().
> > */
> > int iio_device_attach_buffer(struct iio_dev *indio_dev,
> > struct iio_buffer *buffer)
> > diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
> > index d74fbac908df..3be5f75c2846 100644
> > --- a/drivers/iio/industrialio-core.c
> > +++ b/drivers/iio/industrialio-core.c
> > @@ -1587,7 +1587,7 @@ static void iio_dev_release(struct device *device)
> > iio_device_unregister_eventset(indio_dev);
> > iio_device_unregister_sysfs(indio_dev);
> >
> > - iio_buffers_put(indio_dev);
> > + iio_device_detach_buffers(indio_dev);
> >
> > ida_simple_remove(&iio_ida, indio_dev->id);
> > kfree(iio_dev_opaque);
> > --
> > 2.25.1
> >
