Hi,
The patchset fixes invalid memory accesses in certain race scenarios by
moving ownership of struct power_supply to the core. All drivers are
modified.
TLDR for driver and subsystem maintainers
=
Two patches of patchset change power_supply_register() function so in
the same time they touch all drivers. I am kindly asking for acks,
review and help in testing.
Especially please take a look at:
- patch 2: power_supply: Move run-time configuration to separate structure
- patch 11: power_supply: Change ownership from driver to core
These are huge.
Problem to fix
==
Patchset tries to fix invalid memory accesses occurring in following
race scenario:
Thread 1: charger manager, CONSUMER
Thread 2: power supply driver, PROVIDER
THREAD 1 (consumer)THREAD 2 (provider)
======
psy = power_supply_get_by_name()
Driver unbind, .remove
power_supply_unregister()
Device fully removed
psy-get_property()
The consumer of power supply will reference invalid memory because
the provider already freed it.
The fix
===
To properly fix the race the patchset:
1. Moves ownership of power_supply structure from driver (provider) to
power supply core.
2. Adds power_supply_get_property()-like API for safe access by consumer.
3. Adds power_supply_put() which will reclaim memory.
I modifed all drivers I found. However I only compile tested them
(plus Smatch, Sparse and coccicheck). I did not test them on real
hardware (except max14577, max77693, max17040, max17042
and charger-manager).
What the patchset does in steps
===
1. Some preparation steps are necessary - patch 1 and 2. The driver
implementing power supply won't be able to fill structure before
calling power_supply_register(). So 'power_supply_config'
is introduced in patch 2 (power_supply: Move run-time configuration
to separate structure). Unfortunately this touches all drivers.
*All drivers are touched.*
2. Safe API wrappers (and usage counter) are added (power_supply_*()).
3. Patch 11: ownership of 'struct power_supply' is moved from driver
to the core.
*All drivers are touched.*
4. power_supply_put() is added which reclaims resources.
Dependencies
The patchset is rebased on v4.0-rc1 and my latest power supply changes:
1. power_supply: ab8500_fg: Simplify creation and removal of sysfs
entries [4]
2. compal-laptop: two fixes [5].
3. twl4030_madc_battery, ipaq_micro_battery, lp8788-charger: fixes [6].
Bisect-ability is preserved. All later patches depend on previous ones
so it could be pulled in steps, but cherry-picking won't work.
Patchset is available also here:
https://git.linaro.org/people/marek.szyprowski/linux-srpol.git
branch: v4.0-rc1-power-supply-core-ownership
Changes since v3
1. Fix Jonghwa's email in his ack (spotted by Stefan Wahren)
2. Update power_supply_register() documentation.
3. Fix putting the reference to power supply in bq2415x_charger.c (put
it when it is non-NULL).
4. Add acks: Robert Jarzmik (patch 20), Darren Hart (p. 2), Pavel
Machek (p. 1-3), Marc Dietrich (p. 2 and 11).
Changes since v2
1. Rewrite all drivers to new power_supply_register().
2. Add reviewed-by Bartlomiej Zolnierkiewicz (internal review)
3. Add reviewed-by Sebastian Reichel [3] (to patches which I did not
change in major way between v2 and v3).
4. Use atomic usage counter of power supply on each of:
a. register/unregister,
b. get/put.
Changes since v1
1. Add new patches (1, 2, 11, 19).
2. Preserved ack-s where there weren't any changes.
3. Patch 3: Add use counter.
4. Patch 3: Don't add wrapper for set_charged() because already exists
one.
[1] https://lkml.org/lkml/2014/11/4/527
[2] https://lkml.org/lkml/2014/10/16/89
[3] https://lkml.org/lkml/2015/1/21/471
[4] https://lkml.org/lkml/2015/1/29/612
[5] https://lkml.org/lkml/2015/2/20/150
[6] https://lkml.org/lkml/2015/2/20/170
Best regards,
Krzysztof
Krzysztof Kozlowski (20):
power_supply: Add driver private data
power_supply: Move run-time configuration to separate structure
power_supply: Add API for safe access of power supply function attrs
power_supply: sysfs: Use power_supply_*() API for accessing function
attrs
power_supply: 88pm860x_charger: Use power_supply_*() API for accessing
function attrs
power_supply: ab8500: Use power_supply_*() API for accessing function
attrs
mfd: ab8500: Use power_supply_*() API for accessing function attrs
power_supply: apm_power: Use power_supply_*() API for accessing
function attrs
power_supply: bq2415x_charger: Use power_supply_*() API for accessing
function attrs
power_supply: charger-manager: Use power_supply_*() API for accessing
function attrs
power_supply:
