Re: ref_count_t underflow in orion_spi_probe

[Chris Packham <Chris.Packham@xxxxxxxxxxxxxxxxxxx>]

On 19/06/18 01:55, Jan Kundrát wrote:
> On pondělí 18. června 2018 7:06:12 CEST, Chris Packham wrote:
>> Hi Jan,
>>
>> Just hit this on 4.17
>>
>> orion_spi f1010600.spi: Can't request GPIO for CS 17
>> ------------[ cut here ]------------
>> WARNING: CPU: 0 PID: 1 at /home/chrisp/src/linux/lib/refcount.c:187
>> refcount_sub_and_test+0xa0/0xb0
>> refcount_t: underflow; use-after-free.
>> Modules linked in:
>> CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.17.0-at1+ #13
>> Hardware name: Marvell Armada 370/XP (Device Tree)
>> [<801117b4>] (unwind_backtrace) from [<8010c444>] (show_stack+0x10/0x14)
>> [<8010c444>] (show_stack) from [<805ddfcc>] (dump_stack+0x88/0x9c)
>> [<805ddfcc>] (dump_stack) from [<8011c56c>] (__warn+0xfc/0x114)
>> [<8011c56c>] (__warn) from [<8011c5cc>] (warn_slowpath_fmt+0x48/0x6c)
>> [<8011c5cc>] (warn_slowpath_fmt) from [<80355638>]
>> (refcount_sub_and_test+0xa0/0xb0)
>> [<80355638>] (refcount_sub_and_test) from [<805e2460>]
>> (kobject_put+0x28/0xd0)
>> [<805e2460>] (kobject_put) from [<8041cd98>] (orion_spi_probe+0x140/0x4cc)
>> [<8041cd98>] (orion_spi_probe) from [<803c3404>]
>> (platform_drv_probe+0x34/0x70)
>> [<803c3404>] (platform_drv_probe) from [<803c1cfc>]
>> (really_probe+0x230/0x2c8)
>> [<803c1cfc>] (really_probe) from [<803c1e64>] (__driver_attach+0xd0/0xe0)
>> [<803c1e64>] (__driver_attach) from [<803bffd8>]
>> (bus_for_each_dev+0x68/0xb4)
>> [<803bffd8>] (bus_for_each_dev) from [<803c12bc>]
>> (bus_add_driver+0x198/0x210)
>> [<803c12bc>] (bus_add_driver) from [<803c259c>] (driver_register+0x7c/0x114)
>> [<803c259c>] (driver_register) from [<80102ce4>]
>> (do_one_initcall+0x50/0x19c)
>> [<80102ce4>] (do_one_initcall) from [<80800e40>]
>> (kernel_init_freeable+0x148/0x1ec)
>> [<80800e40>] (kernel_init_freeable) from [<805f2100>]
>> (kernel_init+0x8/0x114)
>> [<805f2100>] (kernel_init) from [<801010e8>] (ret_from_fork+0x14/0x2c)
>> Exception stack(0x9c03dfb0 to 0x9c03dff8)
>> dfa0:                                     00000000 00000000 00000000
>> 00000000
>> dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000
>> 00000000
>> dfe0: 00000000 00000000 00000000 00000000 00000013 00000000
>> ---[ end trace 94d7ec3eaf08a007 ]---
>> orion_spi: probe of f1010600.spi failed with error -16
>>
>> My actual problem is probably related to a gpio-hog I have in my dts
>> which will cause devm_gpio_request() to fail but I'm guessing there's
>> something in the error handling that is causing a reference to be
>> released twice.
> 
> Hi Chris, yes, that error is triggered by a call to
> spi_unregister_master(master) which I added in
> 544248623b95eefbe4bea5fa5c68ab0da495eaae. I believe that [1] fixes this
> problem. Can you please give it a try?

Works for me. I'll see if I can reply to the actual patch, but failing that.

Tested-by: Chris Packham <chris.packham@xxxxxxxxxxxxxxxxxxx>

> 
> - if I add an explicit call to spi_unregister_master on top of that patch,
> it starts failing again,
> - if I modify my DTS to introduce an errornous GPIO hog for a GPIO CS pin,
> then "oldish spi_next + patch at [1]" doesn't trigger that refcount
> underflow anymore
> 
> With kind regards,
> Jan
> 
> [1] https://patchwork.kernel.org/patch/10448053/
> 

--
To unsubscribe from this list: send the line "unsubscribe linux-spi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html