kobject: delayed kobject release: help find buggy drivers

Implement debugging for kobject release functions.  kobjects are
reference counted, so the drop of the last reference to them is not
predictable. However, the common case is for the last reference to be
the kobject's removal from a subsystem, which results in the release
function being immediately called.

This can hide subtle bugs, which can occur when another thread holds a
reference to the kobject at the same time that a kobject is removed.
This results in the release method being delayed.

In order to make these kinds of problems more visible, the following
patch implements a delayed release; this has the effect that the
release function will be out of order with respect to the removal of
the kobject in the same manner that it would be if a reference was
being held.

This provides us with an easy way to allow driver writers to debug
their drivers and fix otherwise hidden problems.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 19 insertions, 3 deletions

diff --git a/lib/kobject.c b/lib/kobject.c
index 4a1f33d43548..1d46c151a4ae 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -545,8 +545,8 @@ static void kobject_cleanup(struct kobject *kobj)
         struct kobj_type *t = get_ktype(kobj);
         const char *name = kobj->name;
 
-        pr_debug("kobject: '%s' (%p): %s\n",
-                 kobject_name(kobj), kobj, __func__);
+        pr_debug("kobject: '%s' (%p): %s, parent %p\n",
+                 kobject_name(kobj), kobj, __func__, kobj->parent);
 
         if (t && !t->release)
                 pr_debug("kobject: '%s' (%p): does not have a release() "
@@ -580,9 +580,25 @@ static void kobject_cleanup(struct kobject *kobj)
         }
 }
 
+#ifdef CONFIG_DEBUG_KOBJECT_RELEASE
+static void kobject_delayed_cleanup(struct work_struct *work)
+{
+        kobject_cleanup(container_of(to_delayed_work(work),
+                                     struct kobject, release));
+}
+#endif
+
 static void kobject_release(struct kref *kref)
 {
-        kobject_cleanup(container_of(kref, struct kobject, kref));
+        struct kobject *kobj = container_of(kref, struct kobject, kref);
+#ifdef CONFIG_DEBUG_KOBJECT_RELEASE
+        pr_debug("kobject: '%s' (%p): %s, parent %p (delayed)\n",
+                 kobject_name(kobj), kobj, __func__, kobj->parent);
+        INIT_DELAYED_WORK(&kobj->release, kobject_delayed_cleanup);
+        schedule_delayed_work(&kobj->release, HZ);
+#else
+        kobject_cleanup(kobj);
+#endif
 }
 
 /**