Re: [PATCH] rtc: cmos: remove all __exit_p annotations

[Lars-Peter Clausen]

> -static void __exit cmos_exit(void)
> +static void cmos_exit(void)

This annotation is correct and should stay.

>  {
>  #ifdef   CONFIG_PNP
>   if (pnp_driver_registered)
> 

Re: [PATCH] rtc: cmos: remove all __exit_p annotations

[Lars-Peter Clausen]

> -static void __exit cmos_exit(void)
> +static void cmos_exit(void)

This annotation is correct and should stay.

>  {
>  #ifdef   CONFIG_PNP
>   if (pnp_driver_registered)
> 

[PATCH] rtc: cmos: remove all __exit_p annotations

[Corentin Labbe]

I got the following stack trace under qemu:
[7.575243] BUG: unable to handle kernel NULL pointer dereference at 
0010
[7.596098] IP: [] cmos_set_alarm+0x38/0x280
[7.615699] PGD 3ccbe067
[7.615923] PUD 3daf2067
[7.635156] PMD 0

[7.654358] Oops:  [#1] SMP
[7.673869] Modules linked in:
[7.693235] CPU: 0 PID: 1701 Comm: hwclock Tainted: GW   
4.9.0-rc1+ #24
[7.712455] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 
rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
[7.753569] task: 88003d88dc40 task.stack: c9224000
[7.773743] RIP: 0010:[]  [] 
cmos_set_alarm+0x38/0x280
[7.794893] RSP: 0018:c9227c10  EFLAGS: 00010296
[7.815890] RAX: 001d RBX: c9227d28 RCX: 8182be78
[7.836057] RDX: 0001 RSI: 0202 RDI: 0202
[7.856612] RBP: c9227c48 R08:  R09: 0001
[7.877561] R10: 01c0 R11: 01c0 R12: 
[7.897072] R13: 88003d96f400 R14: 88003dac6410 R15: 88003dac6420
[7.917403] FS:  7f77f42d9700() GS:88003fc0() 
knlGS:
[7.938293] CS:  0010 DS:  ES:  CR0: 80050033
[7.958364] CR2: 0010 CR3: 3ccbb000 CR4: 06f0
[7.978028] Stack:
[7.997120]  88003dac6000 88003dac6410 58049d01 
c9227d28
[8.016993]  88003dac6000 88003dac6410 88003dac6420 
c9227c98
[8.039505]  814f225d 001800227c98 0009002a 
00090011
[8.059985] Call Trace:
[8.080110]  [] __rtc_set_alarm+0x8d/0xa0
[8.099421]  [] rtc_timer_enqueue+0x119/0x190
[8.119925]  [] rtc_update_irq_enable+0xbe/0x100
[8.140583]  [] rtc_dev_ioctl+0x3c0/0x480
[8.161162]  [] ? user_path_at_empty+0x3a/0x50
[8.182717]  [] do_vfs_ioctl+0x96/0x5c0
[8.204624]  [] ? vfs_stat+0x16/0x20
[8.225994]  [] ? SyS_newstat+0x15/0x30
[8.247043]  [] SyS_ioctl+0x47/0x80
[8.267191]  [] entry_SYSCALL_64_fastpath+0x1a/0xa9
[8.288719] Code: 6a 81 48 89 e5 41 57 41 56 41 55 49 89 fd 41 54 53 48 89 
f3 48 c7 c6 20 c4 78 81 48 83 ec 10 e8 8f 00 ef ff 4d 8b a5 a0 00 00 00 <41> 8b 
44 24 10 85 c0 0f 8e 2b 02 00 00 4c 89 ef 31 c0 b9 53 01
[8.335233] RIP  [] cmos_set_alarm+0x38/0x280
[8.357096]  RSP 
[8.379051] CR2: 0010
[8.401736] ---[ end trace 5cbcd83a1f225ed3 ]---

This occur only when CONFIG_DEBUG_TEST_DRIVER_REMOVE is enabled and
CONFIG_RTC_DRV_CMOS builtin.

When cmos_set_alarm() is called dev is NULL and so trigger the deref via
cmos->irq

The problem comes from that the device is removed but no remove function
are called due to _exit_p().

This patch remove all _exit_p() annotation.

Signed-off-by: Corentin Labbe 
---
 drivers/rtc/rtc-cmos.c | 12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index dd3d598..b1f3d64 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -776,7 +776,7 @@ static void cmos_do_shutdown(int rtc_irq)
spin_unlock_irq(_lock);
 }
 
-static void __exit cmos_do_remove(struct device *dev)
+static void cmos_do_remove(struct device *dev)
 {
struct cmos_rtc *cmos = dev_get_drvdata(dev);
struct resource *ports;
@@ -1129,7 +1129,7 @@ static int cmos_pnp_probe(struct pnp_dev *pnp, const 
struct pnp_device_id *id)
pnp_irq(pnp, 0));
 }
 
-static void __exit cmos_pnp_remove(struct pnp_dev *pnp)
+static void cmos_pnp_remove(struct pnp_dev *pnp)
 {
cmos_do_remove(>dev);
 }
@@ -1161,7 +1161,7 @@ static struct pnp_driver cmos_pnp_driver = {
.name   = (char *) driver_name,
.id_table   = rtc_ids,
.probe  = cmos_pnp_probe,
-   .remove = __exit_p(cmos_pnp_remove),
+   .remove = cmos_pnp_remove,
.shutdown   = cmos_pnp_shutdown,
 
/* flag ensures resume() gets called, and stops syslog spam */
@@ -1238,7 +1238,7 @@ static int __init cmos_platform_probe(struct 
platform_device *pdev)
return cmos_do_probe(>dev, resource, irq);
 }
 
-static int __exit cmos_platform_remove(struct platform_device *pdev)
+static int cmos_platform_remove(struct platform_device *pdev)
 {
cmos_do_remove(>dev);
return 0;
@@ -1263,7 +1263,7 @@ static void cmos_platform_shutdown(struct platform_device 
*pdev)
 MODULE_ALIAS("platform:rtc_cmos");
 
 static struct platform_driver cmos_platform_driver = {
-   .remove = __exit_p(cmos_platform_remove),
+   .remove = cmos_platform_remove,
.shutdown   = cmos_platform_shutdown,
.driver = {
.name   = driver_name,
@@ -1305,7 +1305,7 @@ static int __init cmos_init(void)
 }
 module_init(cmos_init);
 
-static void __exit 

[PATCH] rtc: cmos: remove all __exit_p annotations

[Corentin Labbe]

I got the following stack trace under qemu:
[7.575243] BUG: unable to handle kernel NULL pointer dereference at 
0010
[7.596098] IP: [] cmos_set_alarm+0x38/0x280
[7.615699] PGD 3ccbe067
[7.615923] PUD 3daf2067
[7.635156] PMD 0

[7.654358] Oops:  [#1] SMP
[7.673869] Modules linked in:
[7.693235] CPU: 0 PID: 1701 Comm: hwclock Tainted: GW   
4.9.0-rc1+ #24
[7.712455] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 
rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
[7.753569] task: 88003d88dc40 task.stack: c9224000
[7.773743] RIP: 0010:[]  [] 
cmos_set_alarm+0x38/0x280
[7.794893] RSP: 0018:c9227c10  EFLAGS: 00010296
[7.815890] RAX: 001d RBX: c9227d28 RCX: 8182be78
[7.836057] RDX: 0001 RSI: 0202 RDI: 0202
[7.856612] RBP: c9227c48 R08:  R09: 0001
[7.877561] R10: 01c0 R11: 01c0 R12: 
[7.897072] R13: 88003d96f400 R14: 88003dac6410 R15: 88003dac6420
[7.917403] FS:  7f77f42d9700() GS:88003fc0() 
knlGS:
[7.938293] CS:  0010 DS:  ES:  CR0: 80050033
[7.958364] CR2: 0010 CR3: 3ccbb000 CR4: 06f0
[7.978028] Stack:
[7.997120]  88003dac6000 88003dac6410 58049d01 
c9227d28
[8.016993]  88003dac6000 88003dac6410 88003dac6420 
c9227c98
[8.039505]  814f225d 001800227c98 0009002a 
00090011
[8.059985] Call Trace:
[8.080110]  [] __rtc_set_alarm+0x8d/0xa0
[8.099421]  [] rtc_timer_enqueue+0x119/0x190
[8.119925]  [] rtc_update_irq_enable+0xbe/0x100
[8.140583]  [] rtc_dev_ioctl+0x3c0/0x480
[8.161162]  [] ? user_path_at_empty+0x3a/0x50
[8.182717]  [] do_vfs_ioctl+0x96/0x5c0
[8.204624]  [] ? vfs_stat+0x16/0x20
[8.225994]  [] ? SyS_newstat+0x15/0x30
[8.247043]  [] SyS_ioctl+0x47/0x80
[8.267191]  [] entry_SYSCALL_64_fastpath+0x1a/0xa9
[8.288719] Code: 6a 81 48 89 e5 41 57 41 56 41 55 49 89 fd 41 54 53 48 89 
f3 48 c7 c6 20 c4 78 81 48 83 ec 10 e8 8f 00 ef ff 4d 8b a5 a0 00 00 00 <41> 8b 
44 24 10 85 c0 0f 8e 2b 02 00 00 4c 89 ef 31 c0 b9 53 01
[8.335233] RIP  [] cmos_set_alarm+0x38/0x280
[8.357096]  RSP 
[8.379051] CR2: 0010
[8.401736] ---[ end trace 5cbcd83a1f225ed3 ]---

This occur only when CONFIG_DEBUG_TEST_DRIVER_REMOVE is enabled and
CONFIG_RTC_DRV_CMOS builtin.

When cmos_set_alarm() is called dev is NULL and so trigger the deref via
cmos->irq

The problem comes from that the device is removed but no remove function
are called due to _exit_p().

This patch remove all _exit_p() annotation.

Signed-off-by: Corentin Labbe 
---
 drivers/rtc/rtc-cmos.c | 12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index dd3d598..b1f3d64 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -776,7 +776,7 @@ static void cmos_do_shutdown(int rtc_irq)
spin_unlock_irq(_lock);
 }
 
-static void __exit cmos_do_remove(struct device *dev)
+static void cmos_do_remove(struct device *dev)
 {
struct cmos_rtc *cmos = dev_get_drvdata(dev);
struct resource *ports;
@@ -1129,7 +1129,7 @@ static int cmos_pnp_probe(struct pnp_dev *pnp, const 
struct pnp_device_id *id)
pnp_irq(pnp, 0));
 }
 
-static void __exit cmos_pnp_remove(struct pnp_dev *pnp)
+static void cmos_pnp_remove(struct pnp_dev *pnp)
 {
cmos_do_remove(>dev);
 }
@@ -1161,7 +1161,7 @@ static struct pnp_driver cmos_pnp_driver = {
.name   = (char *) driver_name,
.id_table   = rtc_ids,
.probe  = cmos_pnp_probe,
-   .remove = __exit_p(cmos_pnp_remove),
+   .remove = cmos_pnp_remove,
.shutdown   = cmos_pnp_shutdown,
 
/* flag ensures resume() gets called, and stops syslog spam */
@@ -1238,7 +1238,7 @@ static int __init cmos_platform_probe(struct 
platform_device *pdev)
return cmos_do_probe(>dev, resource, irq);
 }
 
-static int __exit cmos_platform_remove(struct platform_device *pdev)
+static int cmos_platform_remove(struct platform_device *pdev)
 {
cmos_do_remove(>dev);
return 0;
@@ -1263,7 +1263,7 @@ static void cmos_platform_shutdown(struct platform_device 
*pdev)
 MODULE_ALIAS("platform:rtc_cmos");
 
 static struct platform_driver cmos_platform_driver = {
-   .remove = __exit_p(cmos_platform_remove),
+   .remove = cmos_platform_remove,
.shutdown   = cmos_platform_shutdown,
.driver = {
.name   = driver_name,
@@ -1305,7 +1305,7 @@ static int __init cmos_init(void)
 }
 module_init(cmos_init);
 
-static void __exit cmos_exit(void)
+static void