gadgetfs regression: module refcount bug since 3.10

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



gadgetfs has had a module refcount bug in all recent kernels, from v3.10 up
through present. I realize that gadgetfs is deprecated in favor of functionfs
nowadays, but probably you will want to fix it anyways since gadgetfs is still
in the tree.

The refcount bug can be reproduced with the following test case (tried on both
ARM and x86-64):

* build gadgetfs as module, build gadgetfs example app from
  http://www.linux-usb.org/gadget/usb.c

* run test script

  modprobe dummy_hcd
  modprobe gadgetfs
  mkdir -p /dev/gadget
  mount -t gadgetfs none /dev/gadget 
  lsmod | grep gadgetfs # this will show usage 1, as expected
  ./usb
  lsmod | grep gadgetfs # still shows usage 1

* now when example app is killed, gadgetfs usage count
  goes from 1 down to 0 (despite still being mounted)

* in fact, the usage count is decremented every time a process exits 
  after using gadgetfs (meaning it goes negative on the 2nd exit)
  
Some poking around showed fops_put() in __fput() being the guilty party for
decrementing the refcount on process exit, which was an unbalanced module put
because running the process didn't do a module get.

More time spent with git-bisect showed that commit 3273097ee9c077
"gadgetfs: don't bother with fops->owner" was the one that caused
the regression. Simply reverting that commit restores old behavior with 
balanced gets and puts: opening gadgetfs files increments the module 
refcount, closing them decrements it.
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux