>> So you suggest that adding of_node_get() to __of_attach_node_sysfs() >> is the right fix ? > > If I understand that this only creates for hot-added cpus then no. Also > for this to be the correct fix I would expect to see this recreate for > all hot-remove operations such as memory and pci devices as well. >
So I can recreate this problem while removing a I/O adapter as well. Here is a trace against 4.11.0-rc1-next20170310 while performing a DLPAR remove operation on a I/O adapter. [ 549.815605] rpaphp: Slot [U78C7.001.RCH0042-P1-C1] registered [ 549.815608] rpadlpar_io: slot PHB 64 added [ 575.267302] iommu: Removing device 0040:01:00.0 from group 1 [ 575.267401] iommu: Removing device 0040:01:00.1 from group 1 [ 575.267842] refcount_t: underflow; use-after-free. [ 575.267855] ------------[ cut here ]------------ [ 575.267862] WARNING: CPU: 2 PID: 3837 at lib/refcount.c:128 refcount_sub_and_test+0xf4/0x110 [ 575.267865] Modules linked in: rpadlpar_io rpaphp dccp_diag dccp tcp_diag udp_diag inet_diag unix_diag af_packet_diag netlink_diag rpcrdma sunrpc ib_isert iscsi_target_mod ib_iser libiscsi scsi_transport_iscsi ib_srpt target_core_mod ib_srp ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm iw_cxgb3 ib_core ghash_generic xts gf128mul tpm_ibmvtpm tpm vmx_crypto pseries_rng sg binfmt_misc ip_tables xfs libcrc32c sr_mod sd_mod cdrom cxgb3 ibmvscsi ibmveth scsi_transport_srp mdio dm_mirror dm_region_hash dm_log dm_mod [ 575.267904] CPU: 2 PID: 3837 Comm: drmgr Not tainted 4.11.0-rc1-next-20170310 #4 [ 575.267907] task: c00000076f041600 task.stack: c00000076f084000 [ 575.267910] NIP: c000000001aa69c4 LR: c000000001aa69c0 CTR: 00000000006338e4 [ 575.267913] REGS: c00000076f0878a0 TRAP: 0700 Not tainted (4.11.0-rc1-next-20170310) [ 575.267915] MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> [ 575.267920] CR: 42002422 XER: 00000007 [ 575.267923] CFAR: c000000001edb5e0 SOFTE: 1 [ 575.267923] GPR00: c000000001aa69c0 c00000076f087b20 c000000002605f00 0000000000000026 [ 575.267923] GPR04: 0000000000000000 800000100fe93ec0 0000000000492b9a 0000000000000000 [ 575.267923] GPR08: 0000000000000001 0000000000000007 0000000000000006 0000000000003ff0 [ 575.267923] GPR12: 0000000000002200 c00000000e801200 0000000000000000 0000000000000000 [ 575.267923] GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 575.267923] GPR20: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 575.267923] GPR24: 0000000000000000 c0000001db50a78c 0000000010016650 0000000000000000 [ 575.267923] GPR28: c0000001dd1a7500 c0000001dd1a7200 c0000001db50a780 c0000001dd1a7258 [ 575.267955] NIP [c000000001aa69c4] refcount_sub_and_test+0xf4/0x110 [ 575.267958] LR [c000000001aa69c0] refcount_sub_and_test+0xf0/0x110 [ 575.267960] Call Trace: [ 575.267962] [c00000076f087b20] [c000000001aa69c0] refcount_sub_and_test+0xf0/0x110 (unreliable) [ 575.267967] [c00000076f087b80] [c000000001a84f1c] kobject_put+0x3c/0xa0 [ 575.267972] [c00000076f087bf0] [c000000001d239b4] of_node_put+0x24/0x40 [ 575.267976] [c00000076f087c10] [c00000000165ce74] ofdt_write+0x204/0x6b0 [ 575.267980] [c00000076f087cd0] [c00000000197bde0] proc_reg_write+0x80/0xd0 [ 575.267984] [c00000076f087d00] [c0000000018df040] __vfs_write+0x40/0x1c0 [ 575.267987] [c00000076f087d90] [c0000000018e0998] vfs_write+0xc8/0x240 [ 575.267991] [c00000076f087de0] [c0000000018e2600] SyS_write+0x60/0x110 [ 575.267995] [c00000076f087e30] [c0000000015cb184] system_call+0x38/0xe0 [ 575.267997] Instruction dump: [ 575.267999] 7863d182 4e800020 7c0802a6 39200001 3d42fff8 3c62ffb1 386306a0 992afd41 [ 575.268004] f8010010 f821ffa1 48434be5 60000000 <0fe00000> 38210060 38600000 e8010010 [ 575.268010] ---[ end trace e6c0a4371a0aa4e2 ]— Thanks -Sachin