f4c36f1999
[ Upstream commit 72139dfa2464e43957d330266994740bb7be2535 ] The struct cdev is embedded in the struct watchdog_core_data. In the current code, we manage the watchdog_core_data with a kref, but the cdev is manged by a kobject. There is no any relationship between this kref and kobject. So it is possible that the watchdog_core_data is freed before the cdev is entirely released. We can easily get the following call trace with CONFIG_DEBUG_KOBJECT_RELEASE and CONFIG_DEBUG_OBJECTS_TIMERS enabled. ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x38 WARNING: CPU: 23 PID: 1028 at lib/debugobjects.c:481 debug_print_object+0xb0/0xf0 Modules linked in: softdog(-) deflate ctr twofish_generic twofish_common camellia_generic serpent_generic blowfish_generic blowfish_common cast5_generic cast_common cmac xcbc af_key sch_fq_codel openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 CPU: 23 PID: 1028 Comm: modprobe Not tainted 5.3.0-next-20190924-yoctodev-standard+ #180 Hardware name: Marvell OcteonTX CN96XX board (DT) pstate: 00400009 (nzcv daif +PAN -UAO) pc : debug_print_object+0xb0/0xf0 lr : debug_print_object+0xb0/0xf0 sp : ffff80001cbcfc70 x29: ffff80001cbcfc70 x28: ffff800010ea2128 x27: ffff800010bad000 x26: 0000000000000000 x25: ffff80001103c640 x24: ffff80001107b268 x23: ffff800010bad9e8 x22: ffff800010ea2128 x21: ffff000bc2c62af8 x20: ffff80001103c600 x19: ffff800010e867d8 x18: 0000000000000060 x17: 0000000000000000 x16: 0000000000000000 x15: ffff000bd7240470 x14: 6e6968207473696c x13: 5f72656d6974203a x12: 6570797420746365 x11: 6a626f2029302065 x10: 7461747320657669 x9 : 7463612820657669 x8 : 3378302f3078302b x7 : 0000000000001d7a x6 : ffff800010fd5889 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff000bff948548 x1 : 276a1c9e1edc2300 x0 : 0000000000000000 Call trace: debug_print_object+0xb0/0xf0 debug_check_no_obj_freed+0x1e8/0x210 kfree+0x1b8/0x368 watchdog_cdev_unregister+0x88/0xc8 watchdog_dev_unregister+0x38/0x48 watchdog_unregister_device+0xa8/0x100 softdog_exit+0x18/0xfec4 [softdog] __arm64_sys_delete_module+0x174/0x200 el0_svc_handler+0xd0/0x1c8 el0_svc+0x8/0xc This is a common issue when using cdev embedded in a struct. Fortunately, we already have a mechanism to solve this kind of issue. Please see commit |
||
|---|---|---|
| .. | ||
| acquirewdt.c | ||
| advantechwdt.c | ||
| alim1535_wdt.c | ||
| alim7101_wdt.c | ||
| ar7_wdt.c | ||
| asm9260_wdt.c | ||
| aspeed_wdt.c | ||
| at91rm9200_wdt.c | ||
| at91sam9_wdt.c | ||
| at91sam9_wdt.h | ||
| ath79_wdt.c | ||
| atlas7_wdt.c | ||
| bcm47xx_wdt.c | ||
| bcm63xx_wdt.c | ||
| bcm2835_wdt.c | ||
| bcm7038_wdt.c | ||
| bcm_kona_wdt.c | ||
| booke_wdt.c | ||
| cadence_wdt.c | ||
| coh901327_wdt.c | ||
| cpu5wdt.c | ||
| cpwd.c | ||
| da9052_wdt.c | ||
| da9055_wdt.c | ||
| da9062_wdt.c | ||
| da9063_wdt.c | ||
| davinci_wdt.c | ||
| diag288_wdt.c | ||
| digicolor_wdt.c | ||
| dw_wdt.c | ||
| ebc-c384_wdt.c | ||
| ep93xx_wdt.c | ||
| eurotechwdt.c | ||
| f71808e_wdt.c | ||
| ftwdt010_wdt.c | ||
| gef_wdt.c | ||
| geodewdt.c | ||
| gpio_wdt.c | ||
| hpwdt.c | ||
| i6300esb.c | ||
| ib700wdt.c | ||
| ibmasr.c | ||
| ie6xx_wdt.c | ||
| imgpdc_wdt.c | ||
| imx2_wdt.c | ||
| indydog.c | ||
| intel-mid_wdt.c | ||
| intel_scu_watchdog.c | ||
| intel_scu_watchdog.h | ||
| iop_wdt.c | ||
| it87_wdt.c | ||
| it8712f_wdt.c | ||
| iTCO_vendor.h | ||
| iTCO_vendor_support.c | ||
| iTCO_wdt.c | ||
| ixp4xx_wdt.c | ||
| jz4740_wdt.c | ||
| Kconfig | ||
| kempld_wdt.c | ||
| ks8695_wdt.c | ||
| lantiq_wdt.c | ||
| loongson1_wdt.c | ||
| lpc18xx_wdt.c | ||
| m54xx_wdt.c | ||
| machzwd.c | ||
| Makefile | ||
| max63xx_wdt.c | ||
| max77620_wdt.c | ||
| mei_wdt.c | ||
| mena21_wdt.c | ||
| menf21bmc_wdt.c | ||
| menz69_wdt.c | ||
| meson_gxbb_wdt.c | ||
| meson_wdt.c | ||
| mixcomwd.c | ||
| moxart_wdt.c | ||
| mpc8xxx_wdt.c | ||
| mt7621_wdt.c | ||
| mtk_wdt.c | ||
| mtx-1_wdt.c | ||
| mv64x60_wdt.c | ||
| ni903x_wdt.c | ||
| nic7018_wdt.c | ||
| npcm_wdt.c | ||
| nuc900_wdt.c | ||
| nv_tco.c | ||
| nv_tco.h | ||
| octeon-wdt-main.c | ||
| octeon-wdt-nmi.S | ||
| of_xilinx_wdt.c | ||
| omap_wdt.c | ||
| omap_wdt.h | ||
| orion_wdt.c | ||
| pc87413_wdt.c | ||
| pcwd.c | ||
| pcwd_pci.c | ||
| pcwd_usb.c | ||
| pic32-dmt.c | ||
| pic32-wdt.c | ||
| pika_wdt.c | ||
| pnx833x_wdt.c | ||
| pnx4008_wdt.c | ||
| pretimeout_noop.c | ||
| pretimeout_panic.c | ||
| qcom-wdt.c | ||
| rave-sp-wdt.c | ||
| rc32434_wdt.c | ||
| rdc321x_wdt.c | ||
| renesas_wdt.c | ||
| retu_wdt.c | ||
| riowd.c | ||
| rn5t618_wdt.c | ||
| rt2880_wdt.c | ||
| rtd119x_wdt.c | ||
| rza_wdt.c | ||
| s3c2410_wdt.c | ||
| sa1100_wdt.c | ||
| sama5d4_wdt.c | ||
| sb_wdog.c | ||
| sbc60xxwdt.c | ||
| sbc7240_wdt.c | ||
| sbc8360.c | ||
| sbc_epx_c3.c | ||
| sbc_fitpc2_wdt.c | ||
| sbsa_gwdt.c | ||
| sc520_wdt.c | ||
| sc1200wdt.c | ||
| sch311x_wdt.c | ||
| scx200_wdt.c | ||
| shwdt.c | ||
| sirfsoc_wdt.c | ||
| smsc37b787_wdt.c | ||
| softdog.c | ||
| sp805_wdt.c | ||
| sp5100_tco.c | ||
| sp5100_tco.h | ||
| sprd_wdt.c | ||
| st_lpc_wdt.c | ||
| stm32_iwdg.c | ||
| stmp3xxx_rtc_wdt.c | ||
| sun4v_wdt.c | ||
| sunxi_wdt.c | ||
| tangox_wdt.c | ||
| tegra_wdt.c | ||
| ts72xx_wdt.c | ||
| ts4800_wdt.c | ||
| twl4030_wdt.c | ||
| txx9wdt.c | ||
| uniphier_wdt.c | ||
| ux500_wdt.c | ||
| via_wdt.c | ||
| w83627hf_wdt.c | ||
| w83877f_wdt.c | ||
| w83977f_wdt.c | ||
| wafer5823wdt.c | ||
| watchdog_core.c | ||
| watchdog_core.h | ||
| watchdog_dev.c | ||
| watchdog_pretimeout.c | ||
| watchdog_pretimeout.h | ||
| wd501p.h | ||
| wdat_wdt.c | ||
| wdrtas.c | ||
| wdt.c | ||
| wdt285.c | ||
| wdt977.c | ||
| wdt_pci.c | ||
| wm831x_wdt.c | ||
| wm8350_wdt.c | ||
| xen_wdt.c | ||
| ziirave_wdt.c | ||
| zx2967_wdt.c | ||