From nobody Wed Dec 17 16:13:10 2025 Received: from ci74p00im-qukt09082501.me.com (ci74p00im-qukt09082501.me.com [17.57.156.14]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4A899233134 for ; Mon, 9 Dec 2024 13:25:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=17.57.156.14 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733750757; cv=none; b=mssaIpq0B77uQWaTHGafEzIi+5DQ+CO6JNKnlvRMykGKCLgO6Sj5ByDbcmi4cyE+wfJvs0Hm8NdLvAi1XgL4eYmC0IEHhzcupW3g6eNsmYYNNabS3tvJq2aKsA7au2FZAzsJdpAI6lIvdpXZr2ruLeI2EvUHsAdXCK3shewRmxQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733750757; c=relaxed/simple; bh=H/i8KSikZ2sUIrUiS2Ekgr/swUIcXlVMiuTTZ8cXyDk=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=BxKvHDGhUbjH6WfG7SDwoVpB1YGVN80QbpuN7ZInyCjWKkhdyWrKPDgVQhNuIFrfbexH0oFvcYh3jTq5CfhQKBbKggRAATKXCDPTEqz/au4PwNODnyXnMBCOctzPr1Zum3WFtZljGTfG11uP6WwTrO1KsNbT+Bb9nMptCo1jVPg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com; spf=pass smtp.mailfrom=icloud.com; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b=SKnXtTZM; arc=none smtp.client-ip=17.57.156.14 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=icloud.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b="SKnXtTZM" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=icloud.com; s=1a1hai; t=1733750755; bh=i3Jdan8uZVn7UNPErfqRxyIjXKkKSwc1fhtcBHUOdM8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To: x-icloud-hme; b=SKnXtTZMhGx41kZA1vddt+ARNRi4myt8jn/Ncn07jvUYQVVIa73VN1MRpsn/TLlSk /8A9WQnZ5WjUAzd6VGiZkV9pJY0HUZrvnkmyRF76IFOdNjuWuo49vwLOM5AtZL7Kp8 tEW2UDvo/ezp8EUgLv+K1eoiyLv+3D0lcPibqIU7A1iPDbNSnfpBm9Ux3ha/2ksRhd mUYXxqQfAp0QLKg/oT/ZDldqCNh2sXsaneiI0CqcYf5XuP3o9HJtVTu9rL5nJdXnro NOCp9ba3HQEYwUSU8UPcODtWVxCR8FwhdbPFAmJ/4UuKpAlP7ARf5bUZobojIeJs9p ohyMVIb3l2f8Q== Received: from [192.168.1.26] (ci77p00im-dlb-asmtp-mailmevip.me.com [17.57.156.26]) by ci74p00im-qukt09082501.me.com (Postfix) with ESMTPSA id 75A7F4AA03B1; Mon, 9 Dec 2024 13:25:33 +0000 (UTC) From: Zijun Hu Date: Mon, 09 Dec 2024 21:24:59 +0800 Subject: [PATCH 1/8] of/irq: Fix wrong value of variable @len in of_irq_parse_imap_parent() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20241209-of_irq_fix-v1-1-782f1419c8a1@quicinc.com> References: <20241209-of_irq_fix-v1-0-782f1419c8a1@quicinc.com> In-Reply-To: <20241209-of_irq_fix-v1-0-782f1419c8a1@quicinc.com> To: Rob Herring , Saravana Kannan , Lorenzo Pieralisi , Bjorn Helgaas , Marc Zyngier , Stefan Wiehler , Grant Likely , Tony Lindgren , Kumar Gala , Thierry Reding , Julia Lawall , Jamie Iles , Grant Likely , Benjamin Herrenschmidt Cc: Zijun Hu , devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, Rob Herring , Zijun Hu , stable@vger.kernel.org X-Mailer: b4 0.14.2 X-Apple-Remote-Links: v=1;h=KCk=;charset=UTF-8 From: Zijun Hu Fix wrong @len value by 'len--' after 'imap++' in of_irq_parse_imap_parent(). Fixes: 935df1bd40d4 ("of/irq: Factor out parsing of interrupt-map parent ph= andle+args from of_irq_parse_raw()") Cc: stable@vger.kernel.org Signed-off-by: Zijun Hu --- drivers/of/irq.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/of/irq.c b/drivers/of/irq.c index 67fc0ceaa5f51c18c14f96f2bb9f82bcb66f890e..43cf60479b9e18eb0eec35f39c1= 47deccd8fe8dd 100644 --- a/drivers/of/irq.c +++ b/drivers/of/irq.c @@ -111,6 +111,7 @@ const __be32 *of_irq_parse_imap_parent(const __be32 *im= ap, int len, struct of_ph else np =3D of_find_node_by_phandle(be32_to_cpup(imap)); imap++; + len--; =20 /* Check if not found */ if (!np) { --=20 2.34.1 From nobody Wed Dec 17 16:13:10 2025 Received: from ci74p00im-qukt09082501.me.com (ci74p00im-qukt09082501.me.com [17.57.156.14]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 49DB11B040E for ; Mon, 9 Dec 2024 13:26:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=17.57.156.14 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733750765; cv=none; b=ZgjRW46Mhvhmqu8V9yRJhOugJD/awWn5rJ9jfm36H1iyUEMjNA+SpioAz0lw0OxNJw9gFtUPaPeQB9hqPCred0dDivxL4mIcmjGzKEHt3UwF/oxRZHpNygFpy1aeYswXKit08jsoe0qrB2qV6qoeUpFg1sLtQLJk7+PYxhzvAbY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733750765; c=relaxed/simple; bh=lunfMj+OkQF1YbU/Hvegdk+70uQ6ogQFARMPAWKoCRQ=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=NqwtrhQU1uBFY6mcFwJwtm7uTt3aHaFGFitB4YGM8V1yTqhaRJv4c2YOv3RpiqN+bXcgWYD8RgO4LVso7twN7lI59VRjv2H4T04ga1wMO8wi21+EhWLR7KU/vzBNQSmhFesEaqt7fl+cPVYPtfLIh6KaIH5TgoGl1T+6buPAo/E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com; spf=pass smtp.mailfrom=icloud.com; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b=rmtwx3AI; arc=none smtp.client-ip=17.57.156.14 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=icloud.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b="rmtwx3AI" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=icloud.com; s=1a1hai; t=1733750762; bh=4VVA4adu+gEU1vT76JzxHosCOPZrovp9nyCp9xo0Oyw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To: x-icloud-hme; b=rmtwx3AIgG9xuJV+aEqXgTvzQNj0F4zHLYHsyL/ZrxWSLOcWMC+EZvEV2bQQJOVac sP9m8ZzkI/Bk9LrpJ3yfx7Ck4uLzMr8kxHVHQhj2vQMNCxXV/EPeirGMS1laCirkN9 qYqcQqc/4d89E3RJ4K0/ausS1JHTA+hgy8LIpJRls29O66fgAdYQelvvWeBqspLAR3 qGD2LYNh+LLMdsWi+KuGWoPMv3o+iKcOdVD85+SumsSBTSiH22/X03jANFhrs9gkfm 7J9qB6udI9J/QrFWKiJYOX5tOipHuFfjc83VXx1/AjM/v+zDLnzeSeyFzl3w7+u+Jx A0VzzbLfrFNlQ== Received: from [192.168.1.26] (ci77p00im-dlb-asmtp-mailmevip.me.com [17.57.156.26]) by ci74p00im-qukt09082501.me.com (Postfix) with ESMTPSA id 1E1D74AA045E; Mon, 9 Dec 2024 13:25:55 +0000 (UTC) From: Zijun Hu Date: Mon, 09 Dec 2024 21:25:00 +0800 Subject: [PATCH 2/8] of/irq: Correct element count for array @dummy_imask in API of_irq_parse_raw() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20241209-of_irq_fix-v1-2-782f1419c8a1@quicinc.com> References: <20241209-of_irq_fix-v1-0-782f1419c8a1@quicinc.com> In-Reply-To: <20241209-of_irq_fix-v1-0-782f1419c8a1@quicinc.com> To: Rob Herring , Saravana Kannan , Lorenzo Pieralisi , Bjorn Helgaas , Marc Zyngier , Stefan Wiehler , Grant Likely , Tony Lindgren , Kumar Gala , Thierry Reding , Julia Lawall , Jamie Iles , Grant Likely , Benjamin Herrenschmidt Cc: Zijun Hu , devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, Rob Herring , Zijun Hu X-Mailer: b4 0.14.2 X-Apple-Remote-Links: v=1;h=KCk=;charset=UTF-8 From: Zijun Hu Array @dummy_imask only needs MAX_PHANDLE_ARGS elements, but it actually has (MAX_PHANDLE_ARGS + 1) elements. Fix by using (MAX_PHANDLE_ARGS - 1) as max element index in initializer. Signed-off-by: Zijun Hu --- drivers/of/irq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/of/irq.c b/drivers/of/irq.c index 43cf60479b9e18eb0eec35f39c147deccd8fe8dd..758eb9b3714868112e83469d131= b244ce77d4e82 100644 --- a/drivers/of/irq.c +++ b/drivers/of/irq.c @@ -171,7 +171,7 @@ int of_irq_parse_raw(const __be32 *addr, struct of_phan= dle_args *out_irq) struct device_node *ipar, *tnode, *old =3D NULL; __be32 initial_match_array[MAX_PHANDLE_ARGS]; const __be32 *match_array =3D initial_match_array; - const __be32 *tmp, dummy_imask[] =3D { [0 ... MAX_PHANDLE_ARGS] =3D cpu_t= o_be32(~0) }; + const __be32 *tmp, dummy_imask[] =3D { [0 ... (MAX_PHANDLE_ARGS - 1)] =3D= cpu_to_be32(~0) }; u32 intsize =3D 1, addrsize; int i, rc =3D -EINVAL; =20 --=20 2.34.1 From nobody Wed Dec 17 16:13:10 2025 Received: from ci74p00im-qukt09082501.me.com (ci74p00im-qukt09082501.me.com [17.57.156.14]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D98FE1ACEB6 for ; Mon, 9 Dec 2024 13:26:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=17.57.156.14 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733750772; cv=none; b=rt9I+g2hl7xDcmD9oy/zxdcP+Tg7MKkTdcdyZWEH4cecJ5IIg4vZ6i8OPio7BsySsjizvOQjLlNAjRDzAA0xwPnSXG0fBV5Cp28Yz0+lZ9ss7SKYCw2TrW3S2bhQBfJpT86P0XUP8XJwnVszfvUxNP//MQZOh/NGzYqe9RdYB+s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733750772; c=relaxed/simple; bh=buSZ9Fabg4Kiu8V1aFg4lCJbzCY/oh3Pk+dTilUwq4k=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=eEn8/yyBzGKbSJNasBB2/vZjU0G8Rn0iBPwQ6+91hhRlSoALa8RFqo3rSinvrOohdm4a5o9qiGxPGAhV4zgqi0QMTZqzmiqgodinlfwDnDDqO7Da6SKkPbq1oqhKZkq69jVVmhO/jTDgGi6SF50T0UePiRX+jNBzPkhLi5x4vpc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com; spf=pass smtp.mailfrom=icloud.com; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b=enocT7A7; arc=none smtp.client-ip=17.57.156.14 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=icloud.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b="enocT7A7" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=icloud.com; s=1a1hai; t=1733750770; bh=C56FTWVpesqYqDvRuOPp99e/7K+5vPCrrmNEn8wL/GI=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To: x-icloud-hme; b=enocT7A7mU6vzg8NHwAFTDtnofY/c5D4tQND8D/4ENwtuaFZ8CV9P3m+qhzdYO/V7 8bR8pBObqoyEXdbJTPlJ6QNtzl1edSmWRcbVCvectRzqYTEdgF/Ln8cjhCXCPZJvCz nyWQukUP5v3+ZEgJpZJo5SSLXVzwbf3LfKlhAMeU9X2dkbyanfXFZeD/bS6ngXPzAG ZXfxnEnTZ0uzKaORclqSgYdP1+jJ+Bz1Z7CUBfspDzZ0i/AfPygjH/AOwpuxoFH0MH 9iDy9fSQewwQCfnsBPR3XDWYxcWUwPdTYdixHxWIWgMBot1E8oyrS1UtQxBBxYIO0b eHk6NkOsodc+Q== Received: from [192.168.1.26] (ci77p00im-dlb-asmtp-mailmevip.me.com [17.57.156.26]) by ci74p00im-qukt09082501.me.com (Postfix) with ESMTPSA id 2DE9A4AA048C; Mon, 9 Dec 2024 13:26:02 +0000 (UTC) From: Zijun Hu Date: Mon, 09 Dec 2024 21:25:01 +0800 Subject: [PATCH 3/8] of/irq: Fix device node refcount leakage in API of_irq_parse_raw() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20241209-of_irq_fix-v1-3-782f1419c8a1@quicinc.com> References: <20241209-of_irq_fix-v1-0-782f1419c8a1@quicinc.com> In-Reply-To: <20241209-of_irq_fix-v1-0-782f1419c8a1@quicinc.com> To: Rob Herring , Saravana Kannan , Lorenzo Pieralisi , Bjorn Helgaas , Marc Zyngier , Stefan Wiehler , Grant Likely , Tony Lindgren , Kumar Gala , Thierry Reding , Julia Lawall , Jamie Iles , Grant Likely , Benjamin Herrenschmidt Cc: Zijun Hu , devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, Rob Herring , Zijun Hu , stable@vger.kernel.org X-Mailer: b4 0.14.2 X-Apple-Remote-Links: v=1;h=KCk=;charset=UTF-8 From: Zijun Hu of_irq_parse_raw() will return when meet condition (@ipar =3D=3D @newpar) but Refcount of device node @out_irq->np was increased twice when directly return there, hence causes @out_irq->np refcount leakage. Fix by putting @out_irq->np refcount before returning there. Fixes: 041284181226 ("of/irq: Allow matching of an interrupt-map local to a= n interrupt controller") Cc: stable@vger.kernel.org Signed-off-by: Zijun Hu --- drivers/of/irq.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/of/irq.c b/drivers/of/irq.c index 758eb9b3714868112e83469d131b244ce77d4e82..cb39624a5e7799b9d2f4525f42d= ac4cd921ab403 100644 --- a/drivers/of/irq.c +++ b/drivers/of/irq.c @@ -310,6 +310,12 @@ int of_irq_parse_raw(const __be32 *addr, struct of_pha= ndle_args *out_irq) addrsize =3D (imap - match_array) - intsize; =20 if (ipar =3D=3D newpar) { + /* + * Has got @ipar's refcount, but the refcount was + * got again by of_irq_parse_imap_parent() via its + * alias @newpair. + */ + of_node_put(ipar); pr_debug("%pOF interrupt-map entry to self\n", ipar); return 0; } --=20 2.34.1 From nobody Wed Dec 17 16:13:10 2025 Received: from ci74p00im-qukt09082501.me.com (ci74p00im-qukt09082501.me.com [17.57.156.14]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4103A1BEF8B for ; Mon, 9 Dec 2024 13:26:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=17.57.156.14 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733750780; cv=none; b=g7WyHjSsAKeg2p96NmE4uHE3enmQs3gACF3vsRd2nWz0Z8SEL+Wf9PJRPLrCqpKxj0F1MxTJcVntHodo1lHZZbq/xb/MkU6bJU1t/493CkN1y/dMVVK1irSuSzUqlAgBta2YeXNWBG5L/Cvz26FoBydYDR0whjwtIj3LLc3/hwo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733750780; c=relaxed/simple; bh=DFw6nTypc9qtDehhi4TlSvMoG4svJBxuwnk7+yt/dgg=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=SUalVzcmi7l672Hxn9VO8AcJd36cASxIOdWCk4P60+SzsTXEWmd9notrWRghV858nHPUvUqJmk6sxLY1GewV5UQ2L5SZ+ghvkguaGqrZFFTXq8+qXLlmTU8SQ1Z+18A3lItRM8xtj2qdLmLOgWDPqU8Ly+VeZLBx6QeDuzMhDy8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com; spf=pass smtp.mailfrom=icloud.com; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b=AvwBMk2Y; arc=none smtp.client-ip=17.57.156.14 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=icloud.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b="AvwBMk2Y" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=icloud.com; s=1a1hai; t=1733750777; bh=43vrn8p072lQRlN2l1v4tjRk4GuMQ/6xBoBVPns9Qjo=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To: x-icloud-hme; b=AvwBMk2YjY2K0SY0cydq9qNeDoqdQeOmUhtGa9ev5jxDty5wZ/H3JW0kuAhAk+j6h RV5LWqFTk0eF5SBSTka/HiIMa1FzunJzEMK2eOKkR2wVxMZGAHa7f755DSuJplVg0d ZTzqcwYsdVm085XqQu/1kiXrHG3dwagLx2xNbsXV6z0sSE8TZG9+JxpxNaVr5eNEy7 f8DxCJHTrx79JvCX+q1OexNid7VJvVOFungD0D2V63nJhjY6LhxPjpa6fJCln6HUrV 221iaBNFHqtuPhmu18ZTrqlOQ3kqiCehULsN06/BPPc684jp+tRsxR5H1/B3PXNLoC 2O0Lj+D5OmG3A== Received: from [192.168.1.26] (ci77p00im-dlb-asmtp-mailmevip.me.com [17.57.156.26]) by ci74p00im-qukt09082501.me.com (Postfix) with ESMTPSA id C41314AA0355; Mon, 9 Dec 2024 13:26:10 +0000 (UTC) From: Zijun Hu Date: Mon, 09 Dec 2024 21:25:02 +0800 Subject: [PATCH 4/8] of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20241209-of_irq_fix-v1-4-782f1419c8a1@quicinc.com> References: <20241209-of_irq_fix-v1-0-782f1419c8a1@quicinc.com> In-Reply-To: <20241209-of_irq_fix-v1-0-782f1419c8a1@quicinc.com> To: Rob Herring , Saravana Kannan , Lorenzo Pieralisi , Bjorn Helgaas , Marc Zyngier , Stefan Wiehler , Grant Likely , Tony Lindgren , Kumar Gala , Thierry Reding , Julia Lawall , Jamie Iles , Grant Likely , Benjamin Herrenschmidt Cc: Zijun Hu , devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, Rob Herring , Zijun Hu , stable@vger.kernel.org X-Mailer: b4 0.14.2 X-Apple-Remote-Links: v=1;h=KCk=;charset=UTF-8 From: Zijun Hu of_irq_parse_one() may use uninitialized variable @addr_len as shown below: // @addr_len is uninitialized int addr_len; // This operation does not touch @addr_len if it fails. addr =3D of_get_property(device, "reg", &addr_len); // Use uninitialized @addr_len if the operation fails. if (addr_len > sizeof(addr_buf)) addr_len =3D sizeof(addr_buf); // Check the operation result here. if (addr) memcpy(addr_buf, addr, addr_len); Fix by initializing @addr_len before the operation. Fixes: b739dffa5d57 ("of/irq: Prevent device address out-of-bounds read in = interrupt map walk") Cc: stable@vger.kernel.org Signed-off-by: Zijun Hu --- drivers/of/irq.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/of/irq.c b/drivers/of/irq.c index cb39624a5e7799b9d2f4525f42dac4cd921ab403..64c005dfa23bd157d891f3f1052= 6327deb5e2cfa 100644 --- a/drivers/of/irq.c +++ b/drivers/of/irq.c @@ -361,6 +361,7 @@ int of_irq_parse_one(struct device_node *device, int in= dex, struct of_phandle_ar return of_irq_parse_oldworld(device, index, out_irq); =20 /* Get the reg property (if any) */ + addr_len =3D 0; addr =3D of_get_property(device, "reg", &addr_len); =20 /* Prevent out-of-bounds read in case of longer interrupt parent address = size */ --=20 2.34.1 From nobody Wed Dec 17 16:13:10 2025 Received: from ci74p00im-qukt09082501.me.com (ci74p00im-qukt09082501.me.com [17.57.156.14]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7E6F31B0425 for ; Mon, 9 Dec 2024 13:26:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=17.57.156.14 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733750786; cv=none; b=b++Wpf/5+mHwab52SWOmkuqV8nmuin8ZLt1yKF6FE88gebc9Jat2CZoqt3JmppgkCLjI0RcVBxn5hG8c+uKhsCz2mp2WTdv21V2TB8ScTaNZram9tz9qavG77VCsmVhJQR8esK+OXqdEaOJrYq/k8ihZD7VVp4w+bJVitHAvNt0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733750786; c=relaxed/simple; bh=5VVqPPvRcjm1Q+UOLuq6uPxhBk493mVdAeWVlp43m0k=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Nx9nLVde33mlkeL0GMAjJOj4OV3047O+A8fsExKKG094sjfTFf/GAXnV/00xxVUQxTdTfpT98hsQQR0gFD8uc5laoSHIzpL0E0hg3uMmFfw4/Yfh916TYxdqICcUXf6dw/HQheiT31Lj1yQI9msPFik42cCC6z1FlEdJ8SLdV+I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com; spf=pass smtp.mailfrom=icloud.com; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b=sjQJpffV; arc=none smtp.client-ip=17.57.156.14 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=icloud.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b="sjQJpffV" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=icloud.com; s=1a1hai; t=1733750784; bh=EaIBefnB5FuCyox/NN+FFgOXA6+EGXb8U8I931UGETA=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To: x-icloud-hme; b=sjQJpffVM2IgDHnlnstHFfttKUJM3XUNkRLBSFeK75TVHYI+mQD/1hSSIPCX+bmkm cSZXAye/P+WJ1aSeOhlSQ1O9exCLVvvT+eCQIdpfudXgzONou/kzD2gv1LTrXh0YiF Xo0NRPRN28oFKc8phxmzkYLRkrs3A5jX1pWs6Ae8yOF3z8nhKA/296kMrtguzQbeDN q6CrsbFFScy/Ob3X4hFx7RyPZsEXrAEbgEDthclb5vJ9XsdNieGmTzu2gCvEGDKeBv SKdLfwQ0u/fKOe7+ZRtIcdZnkY05Ah0a7Vmkp78f60qZXxWqiokAN91QFLRV7kVH4y AEXEcMq+CMgpw== Received: from [192.168.1.26] (ci77p00im-dlb-asmtp-mailmevip.me.com [17.57.156.26]) by ci74p00im-qukt09082501.me.com (Postfix) with ESMTPSA id 27B824AA03F3; Mon, 9 Dec 2024 13:26:17 +0000 (UTC) From: Zijun Hu Date: Mon, 09 Dec 2024 21:25:03 +0800 Subject: [PATCH 5/8] of/irq: Fix device node refcount leakage in API of_irq_parse_one() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20241209-of_irq_fix-v1-5-782f1419c8a1@quicinc.com> References: <20241209-of_irq_fix-v1-0-782f1419c8a1@quicinc.com> In-Reply-To: <20241209-of_irq_fix-v1-0-782f1419c8a1@quicinc.com> To: Rob Herring , Saravana Kannan , Lorenzo Pieralisi , Bjorn Helgaas , Marc Zyngier , Stefan Wiehler , Grant Likely , Tony Lindgren , Kumar Gala , Thierry Reding , Julia Lawall , Jamie Iles , Grant Likely , Benjamin Herrenschmidt Cc: Zijun Hu , devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, Rob Herring , Zijun Hu , stable@vger.kernel.org X-Mailer: b4 0.14.2 X-Apple-Remote-Links: v=1;h=KCk=;charset=UTF-8 From: Zijun Hu For of_irq_parse_one(), refcount of device node @out_irq->np was got by successful of_parse_phandle_with_args() invocation, but it does not put the refcount before return, so causes the device node refcount leakage. Fix by putting the node's refcount before return as the other branch does. Fixes: 79d9701559a9 ("of/irq: create interrupts-extended property") Cc: stable@vger.kernel.org Signed-off-by: Zijun Hu --- drivers/of/irq.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/of/irq.c b/drivers/of/irq.c index 64c005dfa23bd157d891f3f10526327deb5e2cfa..e5a9e24a5bd3606a57a07d0d12d= 3e774e9c78977 100644 --- a/drivers/of/irq.c +++ b/drivers/of/irq.c @@ -373,8 +373,11 @@ int of_irq_parse_one(struct device_node *device, int i= ndex, struct of_phandle_ar /* Try the new-style interrupts-extended first */ res =3D of_parse_phandle_with_args(device, "interrupts-extended", "#interrupt-cells", index, out_irq); - if (!res) - return of_irq_parse_raw(addr_buf, out_irq); + if (!res) { + p =3D out_irq->np; + res =3D of_irq_parse_raw(addr_buf, out_irq); + goto out; + } =20 /* Look for the interrupt parent. */ p =3D of_irq_find_parent(device); --=20 2.34.1 From nobody Wed Dec 17 16:13:10 2025 Received: from ci74p00im-qukt09082501.me.com (ci74p00im-qukt09082501.me.com [17.57.156.14]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BCABD1ACEA1 for ; Mon, 9 Dec 2024 13:26:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=17.57.156.14 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733750794; cv=none; b=GgeUPHg0X6NRn1euVtPAXzG9VEPGp9+BNNzCr1OWi5OIZ514Jt6q2K9e0uTlDh7qluMT8enO3eWL/8xLyxoKTmblY6llNV2TSwF1d4+x2pYK32DoJI14tlB+dXRtKHgvqFpCMMbapwNlbr5etHM3Igqjs+lFgPro3N5cHobWat8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733750794; c=relaxed/simple; bh=VfsUZCz1705t2zpAaYy35+8cMnelhz3feyNDmfryMpE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=JTIefVZzNArLUdCoGn/R9MenUeY7tWqepkgBCEgRJuBJfY27VZyooC0AZxoXcdAok5cY/fNVdHQYVWGa8M/cgfsUr+P3wgxTJgNiAgN2+VBd2MCNekkRctfZMVYzseE1BjtM1/eAWQAs3eejAl2ovuU5HkOeKe21+BXzqAEQ/W8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com; spf=pass smtp.mailfrom=icloud.com; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b=zoDLof4u; arc=none smtp.client-ip=17.57.156.14 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=icloud.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b="zoDLof4u" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=icloud.com; s=1a1hai; t=1733750792; bh=XuLs87F95kBP+DCj58FcSGdEGZ6G9w8J0W6sQBQCzxg=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To: x-icloud-hme; b=zoDLof4urm1ePZqE4cXxpDLtGTqx5x1YbGL3j2Dk9YRtxhm5YWCH2VOhBvRBphL8d MJVnqIUkqDq67SoKIIyUS+ztr+dSdulJ6xL4XqFgrCBeA9aIqv94fSeFzPTECmLQ5V spyg0gTxI8Aku6Q0QdMtwF2F7NM4GyQOCuMw91CYveKF87gRu1QEbNyNJGK8lfLzZg huB6dgVc08KNj5aOec0gz2h3iJp1enUIclq+LgBmjkbL/ZV4mVfjuMCQsxlaG9ot5s ybc5PMpcsxmaLqUWoe7h3vqTJafql2FYWbAw2Mzl5OoVdABawXA+jT4z8UXJ0pxati MpAbMrh8o601w== Received: from [192.168.1.26] (ci77p00im-dlb-asmtp-mailmevip.me.com [17.57.156.26]) by ci74p00im-qukt09082501.me.com (Postfix) with ESMTPSA id 882E84AA041C; Mon, 9 Dec 2024 13:26:25 +0000 (UTC) From: Zijun Hu Date: Mon, 09 Dec 2024 21:25:04 +0800 Subject: [PATCH 6/8] of/irq: Fix device node refcount leakages in of_irq_count() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20241209-of_irq_fix-v1-6-782f1419c8a1@quicinc.com> References: <20241209-of_irq_fix-v1-0-782f1419c8a1@quicinc.com> In-Reply-To: <20241209-of_irq_fix-v1-0-782f1419c8a1@quicinc.com> To: Rob Herring , Saravana Kannan , Lorenzo Pieralisi , Bjorn Helgaas , Marc Zyngier , Stefan Wiehler , Grant Likely , Tony Lindgren , Kumar Gala , Thierry Reding , Julia Lawall , Jamie Iles , Grant Likely , Benjamin Herrenschmidt Cc: Zijun Hu , devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, Rob Herring , Zijun Hu , stable@vger.kernel.org X-Mailer: b4 0.14.2 X-Apple-Remote-Links: v=1;h=KCk=;charset=UTF-8 From: Zijun Hu For of_irq_count(), successful of_irq_parse_one() invocation will get device node @irq.np refcount, of_irq_count() invokes of_irq_parse_one() to count IRQs, and successful invocation of the later will get device node @irq.np refcount, but the former does not put the refcount before next iteration invocation, hence causes device node refcount leakages. Fix by putting @irq.np refcount before the next iteration invocation. Fixes: 3da5278727a8 ("of/irq: Rework of_irq_count()") Cc: stable@vger.kernel.org Signed-off-by: Zijun Hu --- drivers/of/irq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/of/irq.c b/drivers/of/irq.c index e5a9e24a5bd3606a57a07d0d12d3e774e9c78977..d917924d80f563e1392cedc6168= 43365bc638f16 100644 --- a/drivers/of/irq.c +++ b/drivers/of/irq.c @@ -514,8 +514,10 @@ int of_irq_count(struct device_node *dev) struct of_phandle_args irq; int nr =3D 0; =20 - while (of_irq_parse_one(dev, nr, &irq) =3D=3D 0) + while (of_irq_parse_one(dev, nr, &irq) =3D=3D 0) { + of_node_put(irq.np); nr++; + } =20 return nr; } --=20 2.34.1 From nobody Wed Dec 17 16:13:10 2025 Received: from ci74p00im-qukt09082501.me.com (ci74p00im-qukt09082501.me.com [17.57.156.14]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BE0701A2396 for ; Mon, 9 Dec 2024 13:26:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=17.57.156.14 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733750802; cv=none; b=cd5kxzlv/hIqNf7V/DrE4haiDodIN6OxEUAXyG8cLdV6uqp/PifTaq0YWdCvku7otFS0cL6dJLCXDSZmNL8K7q7Tk6ck3ulI8I7K0GHWhX/gy/RGeovkNGStMhfSkTvbtfJckARi3RMvi/k8i3LnTwr0JBAJn4y+Kv1YYzlhN6E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733750802; c=relaxed/simple; bh=vOBJoOrL2GOjzvg2/KzQS+hC+9xTjENJAFJuV21+KHU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=EDPziBhByTk/xDUG7l/zB/M9lyshXcRZ4h4q0W8cFiV/DhqI1zCZ/hQn+aZ3kK0/n4/M8nY1T5fUBVmPyNgtXp1qd7opNecmxZj8JVQQDUZYHowE3qcZxEDHCLn3Etm//3AqGX/JzeNFXmylqCn90H2oR0Kq1po4kEn5WKZ0AY4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com; spf=pass smtp.mailfrom=icloud.com; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b=yw0TlJrE; arc=none smtp.client-ip=17.57.156.14 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=icloud.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b="yw0TlJrE" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=icloud.com; s=1a1hai; t=1733750800; bh=ggXYd9pgZjM1MUcos/NcrgUkTxu66JwJEpIUgGpEx3A=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To: x-icloud-hme; b=yw0TlJrEl4exmcyy2nBsCzk4Y8P1ilcwejsAxqdK2lf/UMvOwZFekyEhRaf1iYaau lE39f0QMzUQAHWOiq6ox/kJ3M9QWCPOxJ7RaYagvptNAYyZGXXxZYzGTCE0Ddgxo1Z U4CZQPAnKzgji4uNh2E+OJksG8I2cfcoTf0n8zgF+Re9ULi1mE9Gy847cDRNoOGTMS C4py3MmZ6D4RZCwj6chIq1Q0qh2xTh5Eu+8rHvqUnjY2OlWT7+4Meu6nH55yxs0rOi 2guiy1pUQYiQl5E3BYcx/ERPpMZGciF97m5RotTVQeLPF7UlrwVIhmbco5rCjwoHzu PKLu9lPFVVl9g== Received: from [192.168.1.26] (ci77p00im-dlb-asmtp-mailmevip.me.com [17.57.156.26]) by ci74p00im-qukt09082501.me.com (Postfix) with ESMTPSA id C7DD14AA042E; Mon, 9 Dec 2024 13:26:32 +0000 (UTC) From: Zijun Hu Date: Mon, 09 Dec 2024 21:25:05 +0800 Subject: [PATCH 7/8] of/irq: Fix device node refcount leakages in of_irq_init() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20241209-of_irq_fix-v1-7-782f1419c8a1@quicinc.com> References: <20241209-of_irq_fix-v1-0-782f1419c8a1@quicinc.com> In-Reply-To: <20241209-of_irq_fix-v1-0-782f1419c8a1@quicinc.com> To: Rob Herring , Saravana Kannan , Lorenzo Pieralisi , Bjorn Helgaas , Marc Zyngier , Stefan Wiehler , Grant Likely , Tony Lindgren , Kumar Gala , Thierry Reding , Julia Lawall , Jamie Iles , Grant Likely , Benjamin Herrenschmidt Cc: Zijun Hu , devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, Rob Herring , Zijun Hu , stable@vger.kernel.org X-Mailer: b4 0.14.2 X-Apple-Remote-Links: v=1;h=KCk=;charset=UTF-8 From: Zijun Hu of_irq_init() will leak interrupt controller device node refcounts in two places as explained below: 1) Leak refcounts of both @desc->dev and @desc->interrupt_parent when suffers @desc->irq_init_cb() failure. 2) Leak refcount of @desc->interrupt_parent when cleans up list @intc_desc_list in the end. Refcounts of both @desc->dev and @desc->interrupt_parent were got in the first loop, but of_irq_init() does not put them before kfree(@desc) in places mentioned above, so causes refcount leakages. Fix by putting refcounts involved before kfree(@desc). Fixes: 8363ccb917c6 ("of/irq: add missing of_node_put") Fixes: c71a54b08201 ("of/irq: introduce of_irq_init") Cc: stable@vger.kernel.org Signed-off-by: Zijun Hu --- drivers/of/irq.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/of/irq.c b/drivers/of/irq.c index d917924d80f563e1392cedc616843365bc638f16..29a58d62d97d1ca4d09a4e4d215= 31b5b9b958494 100644 --- a/drivers/of/irq.c +++ b/drivers/of/irq.c @@ -634,6 +634,8 @@ void __init of_irq_init(const struct of_device_id *matc= hes) __func__, desc->dev, desc->dev, desc->interrupt_parent); of_node_clear_flag(desc->dev, OF_POPULATED); + of_node_put(desc->interrupt_parent); + of_node_put(desc->dev); kfree(desc); continue; } @@ -664,6 +666,7 @@ void __init of_irq_init(const struct of_device_id *matc= hes) err: list_for_each_entry_safe(desc, temp_desc, &intc_desc_list, list) { list_del(&desc->list); + of_node_put(desc->interrupt_parent); of_node_put(desc->dev); kfree(desc); } --=20 2.34.1 From nobody Wed Dec 17 16:13:10 2025 Received: from ci74p00im-qukt09082501.me.com (ci74p00im-qukt09082501.me.com [17.57.156.14]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DD7641B4246 for ; Mon, 9 Dec 2024 13:26:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=17.57.156.14 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733750809; cv=none; b=N+lqDVpDsMmX1dTuZao8EsoUwV8dVM/fzCRpjRot8vJqjViFjm28HPHwQtp2h4sWQ42ZzAndFirPTXqRoJ9ecOl96nbRJFvCvS3mdyvMvwYCwO+GLjXSgxSb5Ufg6VXoeEJsc46FysFZgXEdGCNkrF+bns7r53HKa2KrwF1MuD0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733750809; c=relaxed/simple; bh=K0Lwr+5Zc7hqtyeiWM0OCk8PT5tW57AsknNOd5lB1Dk=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=oDT3U+w7P7Q8pZLk6UaMuPLBZ98nTmYtNORl14RrEhhBhuViHGmnTia6dtvLDXLTvW0B3DpyFplr4MNHUiBiOy4FEGcP53GVsLwu/ApVrRmqqFY2ZBhUkjldt4CjK+KKqW5Pqmdof9xzCR95i+eiFJjZXMLI6YFSmHu53uTwcRU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com; spf=pass smtp.mailfrom=icloud.com; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b=Wso66Tc9; arc=none smtp.client-ip=17.57.156.14 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=icloud.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b="Wso66Tc9" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=icloud.com; s=1a1hai; t=1733750807; bh=o+mb1+yAyOmCC9VR27IaIt7teFx55tYGAzUNXG1KmaU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To: x-icloud-hme; b=Wso66Tc9D+q1txBNGW41589RkhLNh3tjT/q7i4ups0/XZb4hY7jNrnSdkUbJSLzU8 bQ88UlhyUPk+iDNeG7dIwSV/HnQZLNeWzfp/QH+T7PyzEvccAZhpidDODrCfa8jDNH YbRCw4WaXqpQkRjP27+5ZuyQeIAIQZSjrjRAYrFu9rkdQZUIb9DoKTSYFUNRf4L+Jh BoqzGPd81n2WwiDXnrp+M46qQbnOEc7nzJoGntMxMQuIIxakvGpuZcnZKU1t/DFjOO IIbczDQyslVs2aCGzP1q7OCCMHAVpF/hd4uXw+i6TyEs7ZGwLC4gjFOJf39l4CrjpF VTxbw2FMKIJPQ== Received: from [192.168.1.26] (ci77p00im-dlb-asmtp-mailmevip.me.com [17.57.156.26]) by ci74p00im-qukt09082501.me.com (Postfix) with ESMTPSA id A10FB4AA010B; Mon, 9 Dec 2024 13:26:40 +0000 (UTC) From: Zijun Hu Date: Mon, 09 Dec 2024 21:25:06 +0800 Subject: [PATCH 8/8] of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20241209-of_irq_fix-v1-8-782f1419c8a1@quicinc.com> References: <20241209-of_irq_fix-v1-0-782f1419c8a1@quicinc.com> In-Reply-To: <20241209-of_irq_fix-v1-0-782f1419c8a1@quicinc.com> To: Rob Herring , Saravana Kannan , Lorenzo Pieralisi , Bjorn Helgaas , Marc Zyngier , Stefan Wiehler , Grant Likely , Tony Lindgren , Kumar Gala , Thierry Reding , Julia Lawall , Jamie Iles , Grant Likely , Benjamin Herrenschmidt Cc: Zijun Hu , devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, Rob Herring , Zijun Hu , stable@vger.kernel.org X-Mailer: b4 0.14.2 X-Apple-Remote-Links: v=1;h=KCk=;charset=UTF-8 From: Zijun Hu In irq_of_parse_and_map(), refcount of device node @oirq.np was got by successful of_irq_parse_one() invocation, but it does not put the refcount before return, so causes @oirq.np refcount leakage. Fix by putting @oirq.np refcount before return. Fixes: e3873444990d ("of/irq: Move irq_of_parse_and_map() to common code") Cc: stable@vger.kernel.org Signed-off-by: Zijun Hu --- drivers/of/irq.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/of/irq.c b/drivers/of/irq.c index 29a58d62d97d1ca4d09a4e4d21531b5b9b958494..b43c49de935c76cbf1e49391517= dd7b1a569b7fa 100644 --- a/drivers/of/irq.c +++ b/drivers/of/irq.c @@ -38,11 +38,15 @@ unsigned int irq_of_parse_and_map(struct device_node *dev, int index) { struct of_phandle_args oirq; + unsigned int ret; =20 if (of_irq_parse_one(dev, index, &oirq)) return 0; =20 - return irq_create_of_mapping(&oirq); + ret =3D irq_create_of_mapping(&oirq); + of_node_put(oirq.np); + + return ret; } EXPORT_SYMBOL_GPL(irq_of_parse_and_map); =20 --=20 2.34.1