From nobody Sun Apr 19 02:19:40 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 04A1BC43334 for ; Thu, 7 Jul 2022 08:12:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235015AbiGGIMZ (ORCPT ); Thu, 7 Jul 2022 04:12:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54848 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235039AbiGGILz (ORCPT ); Thu, 7 Jul 2022 04:11:55 -0400 Received: from mail-m965.mail.126.com (mail-m965.mail.126.com [123.126.96.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 700DA4D178 for ; Thu, 7 Jul 2022 01:11:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=126.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=0HzhM FxpifCBbW6I6z0WZTmqc/mz0kk5U7sD4ONHr8Y=; b=nYlki+Qz653MUyXmP9S9N dp2gcB9vQ5/El97/KrnDZ/IDUnfW7r1wO1WONyuUyL4e2ZSWIawgua7fz5D9pYn9 /uMnT8eAUoHfYejKPuInRUphjgGoWMmHovWYb4MEgNoL4hqhhtg9S4MM6y3Jhjsx N4gtFzmdMsLLHpxOKQvqe0= Received: from localhost.localdomain (unknown [124.16.139.61]) by smtp10 (Coremail) with SMTP id NuRpCgCH1Xk8lcZidfLLGA--.27011S2; Thu, 07 Jul 2022 16:11:41 +0800 (CST) From: Liang He To: linux-kernel@vger.kernel.org, windhl@126.com Subject: [PATCH] arm-cci: Fix refcount leak bugs Date: Thu, 7 Jul 2022 16:11:39 +0800 Message-Id: <20220707081139.308849-1-windhl@126.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: NuRpCgCH1Xk8lcZidfLLGA--.27011S2 X-Coremail-Antispam: 1Uf129KBjvJXoWxXF1DCF4UWrWrZF47CF4rZrb_yoW5Gr4Upa yYkrWYyrW8Kr4xKFZ2ya45AFZYg34IkrW3Ca47GFnI9wn8JFyYqr409F90vr15AF97Ja4r trs8tF15Ca1vv37anT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x0zEjg4dUUUUU= X-Originating-IP: [124.16.139.61] X-CM-SenderInfo: hzlqvxbo6rjloofrz/xtbBGgU3F1-HZdEL9gAAsu Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" In fact, there are several bugs: (1) In cci_probe(), we should call of_node_put() for the refernece returned by of_find_matching_node() which has increased the refcount. (2) In __cci_ace_get_port(), we should call of_node_put() in fail path or when the reference is not used anymore as the reference is returned by of_parse_phandle() which has increased the refcount. (3) In cci_ace_init_ports(), we should call of_node_put() when the referne is not used anymore as the of_get_cpu_node() will increase the refcount. (4) In cci_probe_ports(), we should call of_node_put() when breaking out of for_each_available_child_of_node() which will automatically increase and decrease refcount. Besides, we should also call of_node_get() for the new reference created in 'ports[i].dn'. Fixes: ed69bdd8fd9b ("drivers: bus: add ARM CCI support") Signed-off-by: Liang He --- For bug(4), I have not found when the global 'ports' is destroyed, so I cannot use 'of_node_put()' for its 'dn'. Please check it carefully. drivers/bus/arm-cci.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/drivers/bus/arm-cci.c b/drivers/bus/arm-cci.c index b8184a903583..d8e66022de5c 100644 --- a/drivers/bus/arm-cci.c +++ b/drivers/bus/arm-cci.c @@ -167,9 +167,12 @@ static int __cci_ace_get_port(struct device_node *dn, = int type) cci_portn =3D of_parse_phandle(dn, "cci-control-port", 0); for (i =3D 0; i < nb_cci_ports; i++) { ace_match =3D ports[i].type =3D=3D type; - if (ace_match && cci_portn =3D=3D ports[i].dn) + if (ace_match && cci_portn =3D=3D ports[i].dn) { + of_node_put(cci_portn); return i; + } } + of_node_put(cci_portn); return -ENODEV; } =20 @@ -199,6 +202,7 @@ static void cci_ace_init_ports(void) continue; =20 port =3D __cci_ace_get_port(cpun, ACE_PORT); + of_node_put(cpun); if (port < 0) continue; =20 @@ -461,8 +465,10 @@ static int cci_probe_ports(struct device_node *np) =20 i =3D nb_ace + nb_ace_lite; =20 - if (i >=3D nb_cci_ports) + if (i >=3D nb_cci_ports) { + of_node_put(cp); break; + } =20 if (of_property_read_string(cp, "interface-type", &match_str)) { @@ -498,7 +504,7 @@ static int cci_probe_ports(struct device_node *np) ports[i].type =3D ACE_LITE_PORT; ++nb_ace_lite; } - ports[i].dn =3D cp; + ports[i].dn =3D of_node_get(cp); } =20 /* @@ -551,7 +557,9 @@ static int cci_probe(void) return -ENXIO; } =20 - return cci_probe_ports(np); + ret =3D cci_probe_ports(np); + of_node_put(np); + return ret; } =20 static int cci_init_status =3D -EAGAIN; --=20 2.25.1