Le 13/05/2021 à 10:09, Russell King - ARM Linux admin a écrit :
On Thu, May 13, 2021 at 08:29:01AM +0200, Christophe JAILLET wrote:
Le 12/05/2021 à 23:44, Russell King - ARM Linux admin a écrit :
On Wed, May 12, 2021 at 11:35:38PM +0200, Christophe JAILLET wrote:
'bus->mii_bus' have been allocated with 'devm_mdiobus_alloc_size()' in the
probe function. So it must not be freed explicitly or there will be a
double free.
Remove the incorrect 'mdiobus_free' in the remove function.
Yes, this looks correct, thanks.
Reviewed-by: Russell King <rmk+kernel@xxxxxxxxxxxxxxx>
However, there's another issue in this driver that ought to be fixed.
If devm_mdiobus_alloc_size() succeeds, but of_mdiobus_register() fails,
we continue on to the next bus (which I think is reasonable.) We don't
free the bus.
When we come to the remove method however, we will call
mdiobus_unregister() on this existent but not-registered bus. Surely we
don't want to do that?
Hmmm, I don't agree here.
'nexus' is 'kzalloc()'ed.
So the pointers in 'buses[]' are all NULL by default.
We set 'nexus->buses[i] = bus' only when all functions that can fail in the
loop have been called. (the very last 'break' is when the array is full)
And in the remove function, we have:
struct cavium_mdiobus *bus = nexus->buses[i];
if (!bus)
continue;
So, this looks safe to me.
It isn't safe. Please look closer.
device_for_each_child_node(&pdev->dev, fwn) {
mii_bus = devm_mdiobus_alloc_size(&pdev->dev, sizeof(*bus));
if (!mii_bus)
break;
bus = mii_bus->priv;
bus->mii_bus = mii_bus;
nexus->buses[i] = bus;
This succeeds and sets nexus->buses[i] to a non-NULL value.
err = of_mdiobus_register(bus->mii_bus, node);
if (err)
dev_err(&pdev->dev, "of_mdiobus_register failed\n");
dev_info(&pdev->dev, "Added bus at %llx\n", r.start);
if (i >= ARRAY_SIZE(nexus->buses))
break;
}
If of_mdiobus_register() fails, the bus is not registered, and we just
move on to the next bus, leaving nexus->buses[i] set to a non-NULL
value.
Got it.
Thx for the explanation.
CJ
