// SPDX-License-Identifier: GPL-2.0 /* * Copyright(c) 2014 Intel Mobile Communications GmbH * Copyright(c) 2015 Intel Deutschland GmbH * * Author: Johannes Berg <[email protected]> */ #include <linux/module.h> #include <linux/device.h> #include <linux/devcoredump.h> #include <linux/list.h> #include <linux/slab.h> #include <linux/fs.h> #include <linux/workqueue.h> static struct class devcd_class; /* global disable flag, for security purposes */ static bool devcd_disabled; struct devcd_entry { … }; static struct devcd_entry *dev_to_devcd(struct device *dev) { … } static void devcd_dev_release(struct device *dev) { … } static void devcd_del(struct work_struct *wk) { … } static ssize_t devcd_data_read(struct file *filp, struct kobject *kobj, struct bin_attribute *bin_attr, char *buffer, loff_t offset, size_t count) { … } static ssize_t devcd_data_write(struct file *filp, struct kobject *kobj, struct bin_attribute *bin_attr, char *buffer, loff_t offset, size_t count) { … } static struct bin_attribute devcd_attr_data = …; static struct bin_attribute *devcd_dev_bin_attrs[] = …; static const struct attribute_group devcd_dev_group = …; static const struct attribute_group *devcd_dev_groups[] = …; static int devcd_free(struct device *dev, void *data) { … } static ssize_t disabled_show(const struct class *class, const struct class_attribute *attr, char *buf) { … } /* * * disabled_store() worker() * class_for_each_device(&devcd_class, * NULL, NULL, devcd_free) * ... * ... * while ((dev = class_dev_iter_next(&iter)) * devcd_del() * device_del() * put_device() <- last reference * error = fn(dev, data) devcd_dev_release() * devcd_free(dev, data) kfree(devcd) * mutex_lock(&devcd->mutex); * * * In the above diagram, It looks like disabled_store() would be racing with parallely * running devcd_del() and result in memory abort while acquiring devcd->mutex which * is called after kfree of devcd memory after dropping its last reference with * put_device(). However, this will not happens as fn(dev, data) runs * with its own reference to device via klist_node so it is not its last reference. * so, above situation would not occur. */ static ssize_t disabled_store(const struct class *class, const struct class_attribute *attr, const char *buf, size_t count) { … } static CLASS_ATTR_RW(disabled); static struct attribute *devcd_class_attrs[] = …; ATTRIBUTE_GROUPS(…); static struct class devcd_class = …; static ssize_t devcd_readv(char *buffer, loff_t offset, size_t count, void *data, size_t datalen) { … } static void devcd_freev(void *data) { … } /** * dev_coredumpv - create device coredump with vmalloc data * @dev: the struct device for the crashed device * @data: vmalloc data containing the device coredump * @datalen: length of the data * @gfp: allocation flags * * This function takes ownership of the vmalloc'ed data and will free * it when it is no longer used. See dev_coredumpm() for more information. */ void dev_coredumpv(struct device *dev, void *data, size_t datalen, gfp_t gfp) { … } EXPORT_SYMBOL_GPL(…); static int devcd_match_failing(struct device *dev, const void *failing) { … } /** * devcd_free_sgtable - free all the memory of the given scatterlist table * (i.e. both pages and scatterlist instances) * NOTE: if two tables allocated with devcd_alloc_sgtable and then chained * using the sg_chain function then that function should be called only once * on the chained table * @data: pointer to sg_table to free */ static void devcd_free_sgtable(void *data) { … } /** * devcd_read_from_sgtable - copy data from sg_table to a given buffer * and return the number of bytes read * @buffer: the buffer to copy the data to it * @buf_len: the length of the buffer * @data: the scatterlist table to copy from * @offset: start copy from @offset@ bytes from the head of the data * in the given scatterlist * @data_len: the length of the data in the sg_table */ static ssize_t devcd_read_from_sgtable(char *buffer, loff_t offset, size_t buf_len, void *data, size_t data_len) { … } /** * dev_coredump_put - remove device coredump * @dev: the struct device for the crashed device * * dev_coredump_put() removes coredump, if exists, for a given device from * the file system and free its associated data otherwise, does nothing. * * It is useful for modules that do not want to keep coredump * available after its unload. */ void dev_coredump_put(struct device *dev) { … } EXPORT_SYMBOL_GPL(…); /** * dev_coredumpm_timeout - create device coredump with read/free methods with a * custom timeout. * @dev: the struct device for the crashed device * @owner: the module that contains the read/free functions, use %THIS_MODULE * @data: data cookie for the @read/@free functions * @datalen: length of the data * @gfp: allocation flags * @read: function to read from the given buffer * @free: function to free the given buffer * @timeout: time in jiffies to remove coredump * * Creates a new device coredump for the given device. If a previous one hasn't * been read yet, the new coredump is discarded. The data lifetime is determined * by the device coredump framework and when it is no longer needed the @free * function will be called to free the data. */ void dev_coredumpm_timeout(struct device *dev, struct module *owner, void *data, size_t datalen, gfp_t gfp, ssize_t (*read)(char *buffer, loff_t offset, size_t count, void *data, size_t datalen), void (*free)(void *data), unsigned long timeout) { … } EXPORT_SYMBOL_GPL(…); /** * dev_coredumpsg - create device coredump that uses scatterlist as data * parameter * @dev: the struct device for the crashed device * @table: the dump data * @datalen: length of the data * @gfp: allocation flags * * Creates a new device coredump for the given device. If a previous one hasn't * been read yet, the new coredump is discarded. The data lifetime is determined * by the device coredump framework and when it is no longer needed * it will free the data. */ void dev_coredumpsg(struct device *dev, struct scatterlist *table, size_t datalen, gfp_t gfp) { … } EXPORT_SYMBOL_GPL(…); static int __init devcoredump_init(void) { … } __initcall(devcoredump_init); static void __exit devcoredump_exit(void) { … } __exitcall(…);
Codebase Browser
linux