• Harald Freudenberger's avatar
    s390/ap: fix ap devices reference counting · 29c2680f
    Harald Freudenberger authored
    With the last rework of the AP bus scan function one get_device() is
    missing causing the reference counter to be one instance too
    low. Together with binding/unbinding device drivers to an ap device it
    may end up in an segfault because the ap device is freed but a device
    driver still assumes it's pointer to the ap device is valid:
    
    Unable to handle kernel pointer dereference in virtual kernel address space
    Failing address: 6b6b6b6b6b6b6000 TEID: 6b6b6b6b6b6b6803
    Fault in home space mode while using kernel ASCE.
    Krnl PSW : 0404e00180000000 000000001472f3b6 (klist_next+0x7e/0x180)
               R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3
    Call Trace:
     [<000000001472f3b6>] klist_next+0x7e/0x180
    ([<000000001472f36a>] klist_next+0x32/0x180)
     [<00000000147c14de>] bus_for_each_dev+0x66/0xb8
     [<0000000014aab0d4>] ap_scan_adapter+0xcc/0x6c0
     [<0000000014aab74a>] ap_scan_bus+0x82/0x140
     [<0000000013f3b654>] process_one_work+0x27c/0x478
     [<0000000013f3b8b6>] worker_thread+0x66/0x368
     [<0000000013f44e32>] kthread+0x17a/0x1a0
     [<0000000014af23e4>] ret_from_fork+0x24/0x2c
    Kernel panic - not syncing: Fatal exception: panic_on_oops
    
    Fixed by adjusting the reference count with get_device() on the right
    place. Also now the device drivers don't need to adjust the ap
    device's reference counting any more. This is now done in the ap bus
    probe and remove functions.
    Reported-by: default avatarMarc Hartmayer <mhartmay@linux.ibm.com>
    Fixes: 4f2fcccd ("s390/ap: add card/queue deconfig state")
    Signed-off-by: default avatarHarald Freudenberger <freude@linux.ibm.com>
    Signed-off-by: default avatarHeiko Carstens <hca@linux.ibm.com>
    29c2680f
zcrypt_queue.c 5.28 KB