tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

mei: fix error flow in probe

Dismantle class device last in probe error flow to avoid accessing
freed memory like:

[ 87.926774] WARNING: CPU: 9 PID: 518 at kernel/workqueue.c:4234
__flush_work+0x340/0x390
...
[ 87.926912] Workqueue: async async_run_entry_fn
[ 87.926918] RIP: e030:__flush_work+0x340/0x390
[ 87.926923] Code: 26 9d 05 00 65 48 8b 15 26 3c ca 02 48 85 db 48 8b
04 24 48 89 54 24 58 0f 85 de fe ff ff e9 f6 fd ff ff 0f 0b e9 77 ff ff
ff <0f> 0b e9 70 ff ff ff 0f 0b e9 19 ff ff ff e8 7d 8b 0e 01 48 89 de
[ 87.926931] RSP: e02b:ffffc900412ebc00 EFLAGS: 00010246
[ 87.926936] RAX: 0000000000000000 RBX: ffff888103e55090 RCX: 0000000000000000
[ 87.926941] RDX: 000fffffffe00000 RSI: 0000000000000001 RDI: ffffc900412ebc60
[ 87.926945] RBP: ffff888103e55090 R08: ffffffffc1266ec8 R09: ffff8881109076e8
[ 87.926949] R10: 0000000080040003 R11: 0000000000000000 R12: ffff888103e54000
[ 87.926953] R13: ffffc900412ebc18 R14: 0000000000000001 R15: 0000000000000000
[ 87.926962] FS: 0000000000000000(0000) GS:ffff888233238000(0000) knlGS:0000000000000000
[ 87.926967] CS: e030 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 87.926971] CR2: 00007e7923b32708 CR3: 00000001088df000 CR4: 0000000000050660
[ 87.926977] Call Trace:
[ 87.926981] <TASK>
[ 87.926987] ? __call_rcu_common.constprop.0+0x11e/0x310
[ 87.926993] cancel_work_sync+0x5e/0x80
[ 87.926999] mei_cancel_work+0x19/0x40 [mei]
[ 87.927051] mei_me_probe+0x273/0x2b0 [mei_me]
[ 87.927060] local_pci_probe+0x45/0x90
[ 87.927066] pci_call_probe+0x5b/0x180
[ 87.927070] pci_device_probe+0x95/0x140
[ 87.927074] ? driver_sysfs_add+0x57/0xc0
[ 87.927079] really_probe+0xde/0x340
[ 87.927083] ? pm_runtime_barrier+0x54/0x90
[ 87.927087] __driver_probe_device+0x78/0x110
[ 87.927092] driver_probe_device+0x1f/0xa0
[ 87.927095] __driver_attach_async_helper+0x5e/0xe0
[ 87.927100] async_run_entry_fn+0x34/0x130
[ 87.927104] process_one_work+0x18d/0x340
[ 87.927108] worker_thread+0x256/0x3a0
[ 87.927111] ? __pfx_worker_thread+0x10/0x10
[ 87.927115] kthread+0xfc/0x240
[ 87.927120] ? __pfx_kthread+0x10/0x10
[ 87.927124] ? __pfx_kthread+0x10/0x10
[ 87.927127] ret_from_fork+0xf5/0x110
[ 87.927132] ? __pfx_kthread+0x10/0x10
[ 87.927136] ret_from_fork_asm+0x1a/0x30
[ 87.927141] </TASK>

Tested-by: Guenter Roeck <groeck@google.com>
Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Closes: https://lore.kernel.org/lkml/aQbYAXPADqfiXUYO@mail-itl/
Reported-by: Guenter Roeck <linux@roeck-us.net>
Closes: https://lore.kernel.org/lkml/8deef7c4-ac75-4db8-91b7-02cf0e39e371@roeck-us.net/
Fixes: 7704e6be4ed2 ("mei: hook mei_device on class device")
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Tested-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Link: https://patch.msgid.link/20251102180836.1203314-1-alexander.usyskin@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Alexander Usyskin and committed by
Greg Kroah-Hartman 1ebc180d 76992675

+17 -20
+6 -7
drivers/misc/mei/pci-me.c
··· 223 223 hw->mem_addr = pcim_iomap_table(pdev)[0]; 224 224 hw->read_fws = mei_me_read_fws; 225 225 226 + err = mei_register(dev, &pdev->dev); 227 + if (err) 228 + goto end; 229 + 226 230 pci_enable_msi(pdev); 227 231 228 232 hw->irq = pdev->irq; ··· 241 237 if (err) { 242 238 dev_err(&pdev->dev, "request_threaded_irq failure. irq = %d\n", 243 239 pdev->irq); 244 - goto end; 240 + goto deregister; 245 241 } 246 - 247 - err = mei_register(dev, &pdev->dev); 248 - if (err) 249 - goto release_irq; 250 242 251 243 if (mei_start(dev)) { 252 244 dev_err(&pdev->dev, "init hw failure.\n"); ··· 283 283 return 0; 284 284 285 285 deregister: 286 - mei_deregister(dev); 287 - release_irq: 288 286 mei_cancel_work(dev); 289 287 mei_disable_interrupts(dev); 290 288 free_irq(pdev->irq, dev); 289 + mei_deregister(dev); 291 290 end: 292 291 dev_err(&pdev->dev, "initialization failed.\n"); 293 292 return err;
+6 -7
drivers/misc/mei/pci-txe.c
··· 87 87 hw = to_txe_hw(dev); 88 88 hw->mem_addr = pcim_iomap_table(pdev); 89 89 90 + err = mei_register(dev, &pdev->dev); 91 + if (err) 92 + goto end; 93 + 90 94 pci_enable_msi(pdev); 91 95 92 96 /* clear spurious interrupts */ ··· 110 106 if (err) { 111 107 dev_err(&pdev->dev, "mei: request_threaded_irq failure. irq = %d\n", 112 108 pdev->irq); 113 - goto end; 109 + goto deregister; 114 110 } 115 - 116 - err = mei_register(dev, &pdev->dev); 117 - if (err) 118 - goto release_irq; 119 111 120 112 if (mei_start(dev)) { 121 113 dev_err(&pdev->dev, "init hw failure.\n"); ··· 145 145 return 0; 146 146 147 147 deregister: 148 - mei_deregister(dev); 149 - release_irq: 150 148 mei_cancel_work(dev); 151 149 mei_disable_interrupts(dev); 152 150 free_irq(pdev->irq, dev); 151 + mei_deregister(dev); 153 152 end: 154 153 dev_err(&pdev->dev, "initialization failed.\n"); 155 154 return err;
+5 -6
drivers/misc/mei/platform-vsc.c
··· 362 362 363 363 ret = mei_register(mei_dev, dev); 364 364 if (ret) 365 - goto err_dereg; 365 + goto err; 366 366 367 367 ret = mei_start(mei_dev); 368 368 if (ret) { 369 369 dev_err_probe(dev, ret, "init hw failed\n"); 370 - goto err_cancel; 370 + goto err; 371 371 } 372 372 373 373 pm_runtime_enable(mei_dev->parent); 374 374 375 375 return 0; 376 376 377 - err_dereg: 378 - mei_deregister(mei_dev); 379 - 380 - err_cancel: 377 + err: 381 378 mei_cancel_work(mei_dev); 382 379 383 380 vsc_tp_register_event_cb(tp, NULL, NULL); 384 381 385 382 mei_disable_interrupts(mei_dev); 383 + 384 + mei_deregister(mei_dev); 386 385 387 386 return ret; 388 387 }