linux/drivers/base
Alex Williamson 321000de04 driver core: Fix unbalanced device reference in drivers_probe
commit 0372ffb35d upstream.

bus_find_device_by_name() acquires a device reference which is never
released.  This results in an object leak, which on older kernels
results in failure to release all resources of PCI devices.  libvirt
uses drivers_probe to re-attach devices to the host after assignment
and is therefore a common trigger for this leak.

Example:

# cd /sys/bus/pci/
# dmesg -C
# echo 1 > devices/0000\:01\:00.0/sriov_numvfs
# echo 0 > devices/0000\:01\:00.0/sriov_numvfs
# dmesg | grep 01:10
 pci 0000:01:10.0: [8086:10ca] type 00 class 0x020000
 kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_add_internal: parent: '0000:00:01.0', set: 'devices'
 kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_uevent_env
 kobject: '0000:01:10.0' (ffff8801d79cd0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0'
 kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_uevent_env
 kobject: '0000:01:10.0' (ffff8801d79cd0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0'
 kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_uevent_env
 kobject: '0000:01:10.0' (ffff8801d79cd0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0'
 kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_cleanup, parent           (null)
 kobject: '0000:01:10.0' (ffff8801d79cd0a8): calling ktype release
 kobject: '0000:01:10.0': free name

[kobject freed as expected]

# dmesg -C
# echo 1 > devices/0000\:01\:00.0/sriov_numvfs
# echo 0000:01:10.0 > drivers_probe
# echo 0 > devices/0000\:01\:00.0/sriov_numvfs
# dmesg | grep 01:10
 pci 0000:01:10.0: [8086:10ca] type 00 class 0x020000
 kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_add_internal: parent: '0000:00:01.0', set: 'devices'
 kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_uevent_env
 kobject: '0000:01:10.0' (ffff8801d79ce0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0'
 kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_uevent_env
 kobject: '0000:01:10.0' (ffff8801d79ce0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0'
 kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_uevent_env
 kobject: '0000:01:10.0' (ffff8801d79ce0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0'

[no free]

Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
History 2015-01-05 13:48:40 +00:00
..
power PM / Sleep: fix async suspend_late/freeze_late error handling 2014-11-13 11:48:48 +00:00
regmap regmap: fix possible ZERO_SIZE_PTR pointer dereferencing error. 2014-10-30 09:40:11 -07:00
attribute_container.c drivers/base: delete non-required instances of include <linux/init.h> 2014-02-14 14:31:37 -08:00
base.h driver core: Move driver_data back to struct device 2014-05-27 12:37:18 -07:00
bus.c driver core: Fix unbalanced device reference in drivers_probe 2015-01-05 13:48:40 +00:00
class.c sysfs: make attr namespace interface less convoluted 2013-09-26 14:50:01 -07:00
component.c drivers/base: fix devres handling for master device 2014-02-07 16:45:14 -08:00
container.c ACPI / hotplug / driver core: Handle containers in a special way 2013-12-29 15:25:48 +01:00
core.c sysfs: driver core: Fix glue dir race condition by gdp_mutex 2014-11-14 15:20:01 +00:00
cpu.c x86: align x86 arch with generic CPU modalias handling 2014-02-18 12:45:38 -08:00
dd.c driver core: Inline dev_set/get_drvdata 2014-05-27 13:46:59 -07:00
devres.c devres: Add devm_get_free_pages API 2014-05-24 02:19:25 +09:00
devtmpfs.c devtmpfs: Calling delete_path() only when necessary 2013-12-19 10:10:32 -08:00
dma-buf.c dma-buf: fix trivial typo error 2014-05-05 15:28:05 +02:00
dma-coherent.c DMA-API: Change dma_declare_coherent_memory() CPU address to phys_addr_t 2014-05-20 16:55:23 -06:00
dma-contiguous.c DMA, CMA: fix possible memory leak 2014-06-23 16:47:44 -07:00
dma-mapping.c DMA-API: Change dma_declare_coherent_memory() CPU address to phys_addr_t 2014-05-20 16:55:23 -06:00
driver.c driver core: add #include <linux/sysfs.h> to core files. 2013-08-27 10:24:15 -07:00
firmware.c firmware: change firmware_kset to firmware_kobj 2008-01-24 20:40:23 -08:00
firmware_class.c firmware_class: make sure fw requests contain a name 2014-10-30 09:40:12 -07:00
hypervisor.c drivers/base: Add export.h for EXPORT_SYMBOL/THIS_MODULE as required. 2011-10-31 19:31:38 -04:00
init.c ACPI / hotplug / driver core: Handle containers in a special way 2013-12-29 15:25:48 +01:00
isa.c dma-mapping: replace all DMA_24BIT_MASK macro with DMA_BIT_MASK(24) 2009-04-07 08:31:12 -07:00
Kconfig cma: increase CMA_ALIGNMENT upper limit to 12 2014-06-04 16:54:08 -07:00
Makefile ACPI and power management updates for 3.14-rc1 2014-01-24 15:51:02 -08:00
map.c [PATCH] kobj_map semaphore to mutex conversion 2006-03-20 13:42:58 -08:00
memory.c memory-hotplug: update documentation to hide information about SECTIONS and remove end_phys_index 2014-06-04 16:53:58 -07:00
module.c driver core: module.c: Use kasprintf 2010-05-21 09:37:29 -07:00
node.c driver/base/node: remove unnecessary kfree of node struct from unregister_one_node 2014-10-15 12:05:31 +02:00
pinctrl.c drivers: pinctrl sleep and idle states in the core 2013-06-16 11:56:52 +02:00
platform.c platform_get_irq: Revert to platform_get_resource if of_irq_get fails 2014-07-11 18:06:36 -07:00
reservation.c reservation: cross-device reservation support, v4 2013-06-28 12:02:15 +10:00
soc.c mode_t whack-a-mole: ->is_visible() returns umode_t... 2012-05-29 23:28:42 -04:00
syscore.c PM / sleep: trace events for suspend/resume 2014-06-07 00:18:07 +02:00
topology.c topology: Fix compilation warning when not in SMP 2014-04-16 14:13:26 -07:00
transport_class.c drivers/base: transport_class explicitly requires EXPORT_SYMBOL 2011-10-31 19:31:15 -04:00