ref_count_t underflow in orion_spi_probe

[Chris Packham <Chris.Packham@xxxxxxxxxxxxxxxxxxx>]

Hi Jan,

Just hit this on 4.17

orion_spi f1010600.spi: Can't request GPIO for CS 17
------------[ cut here ]------------
WARNING: CPU: 0 PID: 1 at /home/chrisp/src/linux/lib/refcount.c:187 
refcount_sub_and_test+0xa0/0xb0
refcount_t: underflow; use-after-free.
Modules linked in:
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.17.0-at1+ #13
Hardware name: Marvell Armada 370/XP (Device Tree)
[<801117b4>] (unwind_backtrace) from [<8010c444>] (show_stack+0x10/0x14)
[<8010c444>] (show_stack) from [<805ddfcc>] (dump_stack+0x88/0x9c)
[<805ddfcc>] (dump_stack) from [<8011c56c>] (__warn+0xfc/0x114)
[<8011c56c>] (__warn) from [<8011c5cc>] (warn_slowpath_fmt+0x48/0x6c)
[<8011c5cc>] (warn_slowpath_fmt) from [<80355638>] 
(refcount_sub_and_test+0xa0/0xb0)
[<80355638>] (refcount_sub_and_test) from [<805e2460>] 
(kobject_put+0x28/0xd0)
[<805e2460>] (kobject_put) from [<8041cd98>] (orion_spi_probe+0x140/0x4cc)
[<8041cd98>] (orion_spi_probe) from [<803c3404>] 
(platform_drv_probe+0x34/0x70)
[<803c3404>] (platform_drv_probe) from [<803c1cfc>] 
(really_probe+0x230/0x2c8)
[<803c1cfc>] (really_probe) from [<803c1e64>] (__driver_attach+0xd0/0xe0)
[<803c1e64>] (__driver_attach) from [<803bffd8>] 
(bus_for_each_dev+0x68/0xb4)
[<803bffd8>] (bus_for_each_dev) from [<803c12bc>] 
(bus_add_driver+0x198/0x210)
[<803c12bc>] (bus_add_driver) from [<803c259c>] (driver_register+0x7c/0x114)
[<803c259c>] (driver_register) from [<80102ce4>] 
(do_one_initcall+0x50/0x19c)
[<80102ce4>] (do_one_initcall) from [<80800e40>] 
(kernel_init_freeable+0x148/0x1ec)
[<80800e40>] (kernel_init_freeable) from [<805f2100>] 
(kernel_init+0x8/0x114)
[<805f2100>] (kernel_init) from [<801010e8>] (ret_from_fork+0x14/0x2c)
Exception stack(0x9c03dfb0 to 0x9c03dff8)
dfa0:                                     00000000 00000000 00000000 
00000000
dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 
00000000
dfe0: 00000000 00000000 00000000 00000000 00000013 00000000
---[ end trace 94d7ec3eaf08a007 ]---
orion_spi: probe of f1010600.spi failed with error -16

My actual problem is probably related to a gpio-hog I have in my dts 
which will cause devm_gpio_request() to fail but I'm guessing there's 
something in the error handling that is causing a reference to be 
released twice.


--
To unsubscribe from this list: send the line "unsubscribe linux-spi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html