d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix device delete child function.

Browse Source 
When detaching device trees parent devices must be detached prior to
detaching its children. This is because parent devices can have
pointers to the child devices in their softcs which are not
invalidated by device_delete_child(). This can cause use after free
issues and panic().

Device drivers implementing trees, must ensure its detach function
detaches or deletes all its children before returning.

While at it remove now redundant device_detach() calls before
device_delete_child() and device_delete_children(), mostly in
the USB controller drivers.

Tested by:		Jan Henrik Sylvester <me@janh.de>
Reviewed by:		jhb
Differential Revision:	https://reviews.freebsd.org/D8070
MFC after:		2 weeks
This commit is contained in:
hselasky 2016-10-17 10:20:38 +00:00
parent 4ae8c3ff61
commit 0c88dabe9d
45 changed files with 20 additions and 269 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sys/arm/allwinner/a10_ehci.c
View File

@ -275,17 +275,11 @@ a10_ehci_detach(device_t self)
struct aw_ehci_softc *aw_sc = device_get_softc(self);
ehci_softc_t *sc = &aw_sc->sc;
const struct aw_ehci_conf *conf;
device_t bdev;
int err;
uint32_t reg_value = 0;
conf = USB_CONF(self);
if (sc->sc_bus.bdev) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(self, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(self);

6
sys/arm/at91/at91_ohci.c
View File

@ -165,14 +165,8 @@ static int
ohci_atmelarm_detach(device_t dev)
{
struct at91_ohci_softc *sc = device_get_softc(dev);
device_t bdev;
int err;
if (sc->sc_ohci.sc_bus.bdev) {
bdev = sc->sc_ohci.sc_bus.bdev;
device_detach(bdev);
device_delete_child(dev, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(dev);

6
sys/arm/at91/at91_ohci_fdt.c
View File

@ -171,14 +171,8 @@ static int
ohci_at91_fdt_detach(device_t dev)
{
struct at91_ohci_softc *sc = device_get_softc(dev);
device_t bdev;
int err;
if (sc->sc_ohci.sc_bus.bdev) {
bdev = sc->sc_ohci.sc_bus.bdev;
device_detach(bdev);
device_delete_child(dev, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(dev);

6
sys/arm/cavium/cns11xx/ehci_ebus.c
View File

@ -184,14 +184,8 @@ static int
ehci_ebus_detach(device_t self)
{
ehci_softc_t *sc = device_get_softc(self);
device_t bdev;
int err;
if (sc->sc_bus.bdev) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(self, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(self);

6
sys/arm/cavium/cns11xx/ohci_ec.c
View File

@ -177,14 +177,8 @@ static int
ohci_ec_detach(device_t dev)
{
struct ec_ohci_softc *sc = device_get_softc(dev);
device_t bdev;
int err;
if (sc->sc_ohci.sc_bus.bdev) {
bdev = sc->sc_ohci.sc_bus.bdev;
device_detach(bdev);
device_delete_child(dev, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(dev);

6
sys/arm/samsung/exynos/exynos5_xhci.c
View File

@ -288,14 +288,8 @@ static int
exynos_xhci_detach(device_t dev)
{
struct exynos_xhci_softc *esc = device_get_softc(dev);
device_t bdev;
int err;
if (esc->base.sc_bus.bdev != NULL) {
bdev = esc->base.sc_bus.bdev;
device_detach(bdev);
device_delete_child(dev, bdev);
}
/* During module unload there are lots of children leftover */
device_delete_children(dev);

11
sys/arm/ti/am335x/am335x_musb.c
View File

@ -366,14 +366,10 @@ static int
musbotg_detach(device_t dev)
{
struct musbotg_super_softc *sc = device_get_softc(dev);
device_t bdev;
int err;
if (sc->sc_otg.sc_bus.bdev) {
bdev = sc->sc_otg.sc_bus.bdev;
device_detach(bdev);
device_delete_child(dev, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(dev);
if (sc->sc_otg.sc_irq_res && sc->sc_otg.sc_intr_hdl) {
/*
@ -397,9 +393,6 @@ musbotg_detach(device_t dev)
bus_release_resource(dev, SYS_RES_IRQ, sc->sc_irq_rid,
sc->sc_otg.sc_irq_res);
/* during module unload there are lots of children leftover */
device_delete_children(dev);
return (0);
}

7
sys/arm/ti/usb/omap_ehci.c
View File

@ -392,15 +392,8 @@ omap_ehci_detach(device_t dev)
{
struct omap_ehci_softc *isc = device_get_softc(dev);
ehci_softc_t *sc = &isc->base;
device_t bdev;
int err;
if (sc->sc_bus.bdev) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(dev, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(dev);

11
sys/arm/xilinx/zy7_ehci.c
View File

@ -323,20 +323,17 @@ zy7_ehci_detach(device_t dev)
{
ehci_softc_t *sc = device_get_softc(dev);
sc->sc_flags &= ~EHCI_SCFLG_DONEINIT;
/* during module unload there are lots of children leftover */
device_delete_children(dev);
if (device_is_attached(dev))
bus_generic_detach(dev);
sc->sc_flags &= ~EHCI_SCFLG_DONEINIT;
if (sc->sc_irq_res && sc->sc_intr_hdl)
/* call ehci_detach() after ehci_init() called after
* successful bus_setup_intr().
*/
ehci_detach(sc);
if (sc->sc_bus.bdev) {
device_detach(sc->sc_bus.bdev);
device_delete_child(dev, sc->sc_bus.bdev);
}
if (sc->sc_irq_res) {
if (sc->sc_intr_hdl != NULL)
bus_teardown_intr(dev, sc->sc_irq_res,

11
sys/boot/kshim/bsd_kernel.c
View File

@ -817,8 +817,12 @@ device_delete_child(device_t dev, device_t child)
int error = 0;
device_t grandchild;
/* remove children first */
/* detach parent before deleting children, if any */
error = device_detach(child);
if (error)
goto done;
/* remove children second */
while ((grandchild = TAILQ_FIRST(&child->dev_children))) {
error = device_delete_child(child, grandchild);
if (error) {
@ -827,11 +831,6 @@ device_delete_child(device_t dev, device_t child)
}
}
error = device_detach(child);
if (error)
goto done;
devclass_delete_device(child->dev_module, child);
if (dev != NULL) {

6
sys/dev/bhnd/cores/usb/bhnd_ehci.c
View File

@ -191,16 +191,10 @@ static int
bhnd_ehci_detach(device_t self)
{
ehci_softc_t *sc;
device_t bdev;
int err;
sc = device_get_softc(self);
if (sc->sc_bus.bdev) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(self, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(self);

6
sys/dev/bhnd/cores/usb/bhnd_ohci.c
View File

@ -163,15 +163,9 @@ static int
bhnd_ohci_detach(device_t self)
{
ohci_softc_t *sc;
device_t bdev;
sc = device_get_softc(self);
if (sc->sc_bus.bdev) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(self, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(self);

3
sys/dev/puc/puc.c
View File

@ -414,8 +414,7 @@ puc_bfe_detach(device_t dev)
port = &sc->sc_port[idx];
if (port->p_dev == NULL)
continue;
if (device_detach(port->p_dev) == 0) {
device_delete_child(dev, port->p_dev);
if (device_delete_child(dev, port->p_dev) == 0) {
if (port->p_rres != NULL)
rman_release_resource(port->p_rres);
if (port->p_ires != NULL)

6
sys/dev/usb/controller/at91dci_atmelarm.c
View File

@ -243,14 +243,8 @@ static int
at91_udp_detach(device_t dev)
{
struct at91_udp_softc *sc = device_get_softc(dev);
device_t bdev;
int err;
if (sc->sc_dci.sc_bus.bdev) {
bdev = sc->sc_dci.sc_bus.bdev;
device_detach(bdev);
device_delete_child(dev, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(dev);

6
sys/dev/usb/controller/at91dci_fdt.c
View File

@ -249,14 +249,8 @@ static int
at91_udp_detach(device_t dev)
{
struct at91_udp_softc *sc = device_get_softc(dev);
device_t bdev;
int err;
if (sc->sc_dci.sc_bus.bdev) {
bdev = sc->sc_dci.sc_bus.bdev;
device_detach(bdev);
device_delete_child(dev, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(dev);

6
sys/dev/usb/controller/atmegadci_atmelarm.c
View File

@ -155,14 +155,8 @@ static int
atmegadci_detach(device_t dev)
{
struct atmegadci_super_softc *sc = device_get_softc(dev);
device_t bdev;
int err;
if (sc->sc_otg.sc_bus.bdev) {
bdev = sc->sc_otg.sc_bus.bdev;
device_detach(bdev);
device_delete_child(dev, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(dev);

6
sys/dev/usb/controller/dwc_otg_fdt.c
View File

@ -163,14 +163,8 @@ static int
dwc_otg_detach(device_t dev)
{
struct dwc_otg_fdt_softc *sc = device_get_softc(dev);
device_t bdev;
int err;
if (sc->sc_otg.sc_bus.bdev) {
bdev = sc->sc_otg.sc_bus.bdev;
device_detach(bdev);
device_delete_child(dev, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(dev);

6
sys/dev/usb/controller/ehci_ixp4xx.c
View File

@ -221,14 +221,8 @@ ehci_ixp_detach(device_t self)
{
struct ixp_ehci_softc *isc = device_get_softc(self);
ehci_softc_t *sc = &isc->base;
device_t bdev;
int err;
if (sc->sc_bus.bdev) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(self, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(self);

6
sys/dev/usb/controller/ehci_mv.c
View File

@ -264,14 +264,8 @@ static int
mv_ehci_detach(device_t self)
{
ehci_softc_t *sc = device_get_softc(self);
device_t bdev;
int err;
if (sc->sc_bus.bdev) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(self, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(self);

6
sys/dev/usb/controller/ehci_pci.c
View File

@ -477,13 +477,7 @@ static int
ehci_pci_detach(device_t self)
{
ehci_softc_t *sc = device_get_softc(self);
device_t bdev;
if (sc->sc_bus.bdev) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(self, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(self);

6
sys/dev/usb/controller/generic_ehci.c
View File

@ -156,14 +156,8 @@ static int
generic_ehci_detach(device_t self)
{
ehci_softc_t *sc = device_get_softc(self);
device_t bdev;
int err;
if (sc->sc_bus.bdev) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(self, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(self);

7
sys/dev/usb/controller/generic_ohci.c
View File

@ -214,18 +214,11 @@ static int
generic_ohci_detach(device_t dev)
{
struct generic_ohci_softc *sc = device_get_softc(dev);
device_t bdev;
int err;
#ifdef EXT_RESOURCES
struct clk_list *clk, *clk_tmp;
#endif
if (sc->ohci_sc.sc_bus.bdev) {
bdev = sc->ohci_sc.sc_bus.bdev;
device_detach(bdev);
device_delete_child(dev, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(dev);

6
sys/dev/usb/controller/musb_otg_atmelarm.c
View File

@ -204,14 +204,8 @@ static int
musbotg_detach(device_t dev)
{
struct musbotg_super_softc *sc = device_get_softc(dev);
device_t bdev;
int err;
if (sc->sc_otg.sc_bus.bdev) {
bdev = sc->sc_otg.sc_bus.bdev;
device_detach(bdev);
device_delete_child(dev, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(dev);

6
sys/dev/usb/controller/ohci_pci.c
View File

@ -335,13 +335,7 @@ static int
ohci_pci_detach(device_t self)
{
ohci_softc_t *sc = device_get_softc(self);
device_t bdev;
if (sc->sc_bus.bdev) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(self, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(self);

6
sys/dev/usb/controller/ohci_s3c24x0.c
View File

@ -148,14 +148,8 @@ static int
ohci_s3c24x0_detach(device_t dev)
{
struct ohci_softc *sc = device_get_softc(dev);
device_t bdev;
int err;
if (sc->sc_bus.bdev) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(dev, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(dev);

7
sys/dev/usb/controller/saf1761_otg_boot.c
View File

@ -124,13 +124,6 @@ static int
saf1761_otg_fdt_detach(device_t dev)
{
struct saf1761_otg_softc *sc = device_get_softc(dev);
device_t bdev;
if (sc->sc_bus.bdev) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(dev, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(dev);

6
sys/dev/usb/controller/saf1761_otg_fdt.c
View File

@ -238,14 +238,8 @@ static int
saf1761_otg_fdt_detach(device_t dev)
{
struct saf1761_otg_softc *sc = device_get_softc(dev);
device_t bdev;
int err;
if (sc->sc_bus.bdev) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(dev, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(dev);

6
sys/dev/usb/controller/uhci_pci.c
View File

@ -393,13 +393,7 @@ int
uhci_pci_detach(device_t self)
{
uhci_softc_t *sc = device_get_softc(self);
device_t bdev;
if (sc->sc_bus.bdev) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(self, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(self);

6
sys/dev/usb/controller/uss820dci_atmelarm.c
View File

@ -164,14 +164,8 @@ static int
uss820_atmelarm_detach(device_t dev)
{
struct uss820dci_softc *sc = device_get_softc(dev);
device_t bdev;
int err;
if (sc->sc_bus.bdev) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(dev, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(dev);

7
sys/dev/usb/controller/xhci_mv.c
View File

@ -171,15 +171,8 @@ static int
xhci_detach(device_t dev)
{
struct xhci_softc *sc = device_get_softc(dev);
device_t bdev;
int err;
if (sc->sc_bus.bdev != NULL) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(dev, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(dev);

6
sys/dev/usb/controller/xhci_pci.c
View File

@ -340,13 +340,7 @@ static int
xhci_pci_detach(device_t self)
{
struct xhci_softc *sc = device_get_softc(self);
device_t bdev;
if (sc->sc_bus.bdev != NULL) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(self, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(self);

4
sys/dev/usb/usb_device.c
View File

@ -1103,10 +1103,8 @@ usb_detach_device_sub(struct usb_device *udev, device_t *ppdev,
device_printf(dev, "Resume failed\n");
}
}
if (device_detach(dev)) {
goto error;
}
}
/* detach and delete child */
if (device_delete_child(udev->parent_dev, dev)) {
goto error;
}

9
sys/dev/usb/video/udl.c
View File

@ -443,14 +443,9 @@ udl_detach(device_t dev)
{
struct udl_softc *sc = device_get_softc(dev);
if (sc->sc_fbdev != NULL) {
device_t bdev;
/* delete all child devices */
device_delete_children(dev);
bdev = sc->sc_fbdev;
sc->sc_fbdev = NULL;
device_detach(bdev);
device_delete_child(dev, bdev);
}
UDL_LOCK(sc);
sc->sc_gone = 1;
callout_stop(&sc->sc_callout);

8
sys/kern/subr_bus.c
View File

@ -1949,15 +1949,17 @@ device_delete_child(device_t dev, device_t child)
PDEBUG(("%s from %s", DEVICENAME(child), DEVICENAME(dev)));
/* remove children first */
/* detach parent before deleting children, if any */
if ((error = device_detach(child)) != 0)
return (error);
/* remove children second */
while ((grandchild = TAILQ_FIRST(&child->children)) != NULL) {
error = device_delete_child(child, grandchild);
if (error)
return (error);
}
if ((error = device_detach(child)) != 0)
return (error);
if (child->devclass)
devclass_delete_device(child->devclass, child);
if (child->parent)

6
sys/mips/atheros/ar71xx_ehci.c
View File

@ -231,14 +231,8 @@ ar71xx_ehci_detach(device_t self)
{
struct ar71xx_ehci_softc *isc = device_get_softc(self);
ehci_softc_t *sc = &isc->base;
device_t bdev;
int err;
if (sc->sc_bus.bdev) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(self, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(self);

6
sys/mips/atheros/ar71xx_ohci.c
View File

@ -156,13 +156,7 @@ static int
ar71xx_ohci_detach(device_t dev)
{
struct ar71xx_ohci_softc *sc = device_get_softc(dev);
device_t bdev;
if (sc->sc_ohci.sc_bus.bdev) {
bdev = sc->sc_ohci.sc_bus.bdev;
device_detach(bdev);
device_delete_child(dev, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(dev);

6
sys/mips/cavium/usb/octusb_octeon.c
View File

@ -160,16 +160,10 @@ static int
octusb_octeon_detach(device_t dev)
{
struct octusb_octeon_softc *sc = device_get_softc(dev);
device_t bdev;
int err;
int nports;
int i;
if (sc->sc_dci.sc_bus.bdev) {
bdev = sc->sc_dci.sc_bus.bdev;
device_detach(bdev);
device_delete_child(dev, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(dev);

6
sys/mips/mediatek/mtk_dotg.c
View File

@ -161,14 +161,8 @@ static int
dotg_fdt_detach(device_t dev)
{
struct dwc_otg_softc *sc = device_get_softc(dev);
device_t bdev;
int err;
if (sc->sc_bus.bdev) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(dev, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(dev);

6
sys/mips/mediatek/mtk_ehci.c
View File

@ -162,14 +162,8 @@ static int
ehci_fdt_detach(device_t self)
{
ehci_softc_t *sc = device_get_softc(self);
device_t bdev;
int err;
if (sc->sc_bus.bdev) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(self, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(self);

6
sys/mips/mediatek/mtk_ohci.c
View File

@ -162,14 +162,8 @@ static int
ohci_fdt_detach(device_t self)
{
ohci_softc_t *sc = device_get_softc(self);
device_t bdev;
int err;
if (sc->sc_bus.bdev) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(self, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(self);

6
sys/mips/mediatek/mtk_xhci.c
View File

@ -161,14 +161,8 @@ static int
mtk_xhci_fdt_detach(device_t self)
{
struct xhci_softc *sc = device_get_softc(self);
device_t bdev;
int err;
if (sc->sc_bus.bdev) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(self, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(self);

6
sys/mips/rmi/xls_ehci.c
View File

@ -164,14 +164,8 @@ static int
ehci_xls_detach(device_t self)
{
ehci_softc_t *sc = device_get_softc(self);
device_t bdev;
int err;
if (sc->sc_bus.bdev) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(self, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(self);

6
sys/mips/rt305x/rt305x_dotg.c
View File

@ -173,14 +173,8 @@ static int
dotg_obio_detach(device_t dev)
{
struct dwc_otg_softc *sc = device_get_softc(dev);
device_t bdev;
int err;
if (sc->sc_bus.bdev) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(dev, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(dev);

6
sys/mips/rt305x/rt305x_ehci.c
View File

@ -175,14 +175,8 @@ static int
ehci_obio_detach(device_t self)
{
ehci_softc_t *sc = device_get_softc(self);
device_t bdev;
int err;
if (sc->sc_bus.bdev) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(self, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(self);

6
sys/mips/rt305x/rt305x_ohci.c
View File

@ -175,14 +175,8 @@ static int
ohci_obio_detach(device_t self)
{
ohci_softc_t *sc = device_get_softc(self);
device_t bdev;
int err;
if (sc->sc_bus.bdev) {
bdev = sc->sc_bus.bdev;
device_detach(bdev);
device_delete_child(self, bdev);
}
/* during module unload there are lots of children leftover */
device_delete_children(self);