rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev
authorMatthias Kaehlcke <mka@chromium.org>
Mon, 10 Jan 2022 18:47:37 +0000 (10:47 -0800)
committerBjorn Andersson <bjorn.andersson@linaro.org>
Mon, 17 Jan 2022 22:39:58 +0000 (16:39 -0600)
commit7a534ae89e34e9b51acb5a63dd0f88308178b46a
treea09d85b99f2be06443a6ec142cfa2702b935444f
parentb7fb2dad571d1e21173c06cef0bced77b323990a
rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev

struct rpmsg_eptdev contains a struct cdev. The current code frees
the rpmsg_eptdev struct in rpmsg_eptdev_destroy(), but the cdev is
a managed object, therefore its release is not predictable and the
rpmsg_eptdev could be freed before the cdev is entirely released.

The cdev_device_add/del() API was created to address this issue
(see commit '233ed09d7fda ("chardev: add helper function to register
char devs with a struct device")'), use it instead of cdev add/del().

Fixes: c0cdc19f84a4 ("rpmsg: Driver for user space endpoint interface")
Suggested-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Link: https://lore.kernel.org/r/20220110104706.v6.2.Idde68b05b88d4a2e6e54766c653f3a6d9e419ce6@changeid
drivers/rpmsg/rpmsg_char.c