On Tue. 27 Nov. 2022 at 01:51, Andrew Lunn <andrew@xxxxxxx> wrote: > > @@ -2196,11 +2198,12 @@ static struct es58x_device *es58x_init_es58x_dev(struct usb_interface *intf, > > ops = &es581_4_ops; > > } > > > > - es58x_dev = devm_kzalloc(dev, es58x_sizeof_es58x_device(param), > > - GFP_KERNEL); > > - if (!es58x_dev) > > + devlink = devlink_alloc(&es58x_dl_ops, es58x_sizeof_es58x_device(param), > > + dev); > > + if (!devlink) > > return ERR_PTR(-ENOMEM); > > > > + es58x_dev = devlink_priv(devlink); > > That is 'interesting'. Another interesting thing I found is: https://elixir.bootlin.com/linux/v6.1-rc6/source/drivers/net/ethernet/intel/ice/ice_devlink.c#L866 Because devlink does not have an equivalent to devm_kzalloc(), that driver uses devm_add_action_or_reset() instead. But any other drivers will call devlink_free() in their disconnect function. So here, I just followed the trend. > Makes me wonder about lifetimes of different > objects. Previously your es58x_dev structure would disappear when the > driver is released, or an explicit call to devm_kfree(). Now it > disappears when devlink_free() is called. Even before that, this driver used to release es58x_dev in its disconnect() function. I changed it to use devm_kzalloc() last year after discovering its existence. https://git.kernel.org/torvalds/linux/c/6bde4c7fd845 >Any danger of use after free here? devlink_alloc() allocates one continuous block for both the devlink and the device priv (struct es58x_dev here): https://elixir.bootlin.com/linux/v6.1-rc6/source/net/core/devlink.c#L9629 So calling devlink_free() also releases struct es58x_dev. > USB devices always make me wonder about life times rules since they > are probably the mode dynamic sort of device the kernel has the > handle, them just abruptly disappearing. > > > es58x_dev->param = param; > > es58x_dev->ops = ops; > > es58x_dev->dev = dev; > > @@ -2247,6 +2250,8 @@ static int es58x_probe(struct usb_interface *intf, > > if (ret) > > return ret; > > > > + devlink_register(priv_to_devlink(es58x_dev)); > > + > > for (ch_idx = 0; ch_idx < es58x_dev->num_can_ch; ch_idx++) { > > ret = es58x_init_netdev(es58x_dev, ch_idx); > > if (ret) { > > @@ -2272,8 +2277,10 @@ static void es58x_disconnect(struct usb_interface *intf) > > dev_info(&intf->dev, "Disconnecting %s %s\n", > > es58x_dev->udev->manufacturer, es58x_dev->udev->product); > > > > + devlink_unregister(priv_to_devlink(es58x_dev)); > > es58x_free_netdevs(es58x_dev); > > es58x_free_urbs(es58x_dev); > > + devlink_free(priv_to_devlink(es58x_dev)); > > usb_set_intfdata(intf, NULL); > > Should devlink_free() be after usb_set_inftdata()? A look at $ git grep -W "usb_set_intfdata(.*NULL)" shows that the two patterns (freeing before or after usb_set_intfdata()) coexist. You are raising an important question here. usb_set_intfdata() does not have documentation that freeing before it is risky. And the documentation of usb_driver::disconnect says that: "@disconnect: Called when the interface is no longer accessible, usually because its device has been (or is being) disconnected or the driver module is being unloaded." Ref: https://elixir.bootlin.com/linux/v6.1-rc6/source/include/linux/usb.h#L1130 So the interface no longer being accessible makes me assume that the order does not matter. If it indeed matters, then this is a foot gun and there is some clean-up work waiting for us on many drivers. @Greg, any thoughts on whether or not the order of usb_set_intfdata() and resource freeing matters or not? Yours sincerely, Vincent Mailhol
