Re: [Ksummit-discuss] [TECH TOPIC] Fix devm_kzalloc, its users, or both

[Linus Walleij <linus.walleij@linaro.org>]

On Fri, Jul 31, 2015 at 5:14 PM, Laurent Pinchart
<laurent.pinchart@ideasonboard.com> wrote:

> The issue occurs when drivers use devm_kzalloc() to allocate data structures
> that can be accessed through file operations on a device node. The following
> sequence of events will then lead to a crash.
>
> 1. Get a device bound to its driver
> 2. Open the corresponding device node in userspace and keep it open
> 3. Unbind the device from its driver through sysfs using for instance
>
> echo <device-name> > /sys/bus/platform/drivers/<driver-name>/unbind
>
> (or for hotpluggable devices just unplug the device)
>
> 4. Close the device node
> 5. Enjoy the fireworks

I've encountered it a few times in review, not in practice, a
relevant part of the question is whether your driver really cannot
live without the bind/unbind attributes in sysfs. I've realized that
I don't use them, and I suspect that for a largeish set of drivers
the developers don't use it.

I've started to think that the .suppress_bind_attrs = true in
struct device_driver is often your friend, simplifying the world.

I've actually thought about trying to set that for *any* GPIO
driver if they enable the sysfs access to GPIOs as these
dangling userspace users is a common problem here, but since
we also want to have hotplug/unplug of these hosts it's maybe
a real bad idea, as these sysfs files are good for testing that.

Yours,
Linus Walleij