From nobody Tue Dec 16 14:25:04 2025 Received: from pv50p00im-ztdg10021101.me.com (pv50p00im-ztdg10021101.me.com [17.58.6.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6DD501BC065 for ; Sun, 9 Feb 2025 12:59:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=17.58.6.44 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739105985; cv=none; b=RrytUk2GavwBmd0l9LKNMjSMlP934/p3l9taIEsY/axqu7SBDkqgaP0IQ2i8LH/UsOe/jiJJ4c3NZL0hjW+8KkQCdSgDfPidCqZJAxkKBTFcFhNI3SuuKJ8BpGCM/yrJ2sA2c3SJxKMAwhrf+cmAne8ljTC1VhH9/J4SvtxIb2s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739105985; c=relaxed/simple; bh=yUrZq/119igB2w0eCWpSZBjHfbejt2CC8kiwWpNdHZY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=okIDQmIVWfSoOnJOeJpyAGoUrjpYQVztQlBYbZxEPMarQB7DND7qyNxK6bMQCYIPBXOEkHCFQfeURDK0fQMLaVHNVoEptdB8SvYUN367GNlvcd4paHfjiP0JM1xNAE+lnWmRwrZREs8mMpCVh0kYiHbzuohX4dDyjXxv+zEefGU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com; spf=pass smtp.mailfrom=icloud.com; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b=V1ZaqkA2; arc=none smtp.client-ip=17.58.6.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=icloud.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b="V1ZaqkA2" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=icloud.com; s=1a1hai; bh=PmKeKoMvm+sqd7jiaFBivxOuYoCBp3qBT9MZwpC/Mpw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:x-icloud-hme; b=V1ZaqkA2CFbhSgA05reFbjnzKcQgWRyjC1lHxFVg/pp4fzIyBnfUhaenfH0UcxgM4 +l03rtjeJF1wCNo9qk+BCrhAYUqDKI7VtOH1LCXV2z7BfsALVpGB8HfRkHp6Qauh+M oAepFDdTJ8X5IpmaUG/iWCjrc3VfzZTLVxSTWk3gWyT/cj6qkaIk6O4nCljE/MoGpF DsPssJPo+tEYdRWPkvbX0wAR/i+1lJTWQJp7Ou2YxlUHOvrn8zhH+/gsE8J9iqjXlP aWmWJXWw6CoZaDevLHMLjUXSiRqDpDzDpsMevaKS5LDH1eV2ClH1pucZw77uq5lzPJ p10NS5Pvrd7Mg== Received: from [192.168.1.26] (pv50p00im-dlb-asmtp-mailmevip.me.com [17.56.9.10]) by pv50p00im-ztdg10021101.me.com (Postfix) with ESMTPSA id 4E365D00261; Sun, 9 Feb 2025 12:59:37 +0000 (UTC) From: Zijun Hu Date: Sun, 09 Feb 2025 20:58:54 +0800 Subject: [PATCH v2 1/9] of: unittest: Add a case to test if API of_irq_parse_one() leaks refcount Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20250209-of_irq_fix-v2-1-93e3a2659aa7@quicinc.com> References: <20250209-of_irq_fix-v2-0-93e3a2659aa7@quicinc.com> In-Reply-To: <20250209-of_irq_fix-v2-0-93e3a2659aa7@quicinc.com> To: Rob Herring , Saravana Kannan , Lorenzo Pieralisi , Bjorn Helgaas , Marc Zyngier , Stefan Wiehler , Tony Lindgren , Thierry Reding , Benjamin Herrenschmidt , Julia Lawall Cc: Zijun Hu , devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, Zijun Hu X-Mailer: b4 0.14.2 X-Proofpoint-GUID: bOCVLMMmO9CeyS7QWX5R2_XFkh9aqqtk X-Proofpoint-ORIG-GUID: bOCVLMMmO9CeyS7QWX5R2_XFkh9aqqtk X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1057,Hydra:6.0.680,FMLib:17.12.68.34 definitions=2025-02-09_05,2025-02-07_03,2024-11-22_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 malwarescore=0 mlxlogscore=999 phishscore=0 mlxscore=0 clxscore=1015 suspectscore=0 bulkscore=0 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2308100000 definitions=main-2502090115 X-Apple-Remote-Links: v=1;h=KCk=;charset=UTF-8 From: Zijun Hu To test if of_irq_parse_one(@int_gen_dev, i, ...) will leak refcount of @i_th_phandle. int_gen_dev { ... interrupts-extended =3D ..., <&i_th_phandle ...>, ...; ... }; Signed-off-by: Zijun Hu --- drivers/of/unittest.c | 45 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c index f88ddb1cf5d7f75ac90eeff1f944d563df56f2d3..48aec4695fff647226697fefcae= 696adaa307480 100644 --- a/drivers/of/unittest.c +++ b/drivers/of/unittest.c @@ -1654,6 +1654,50 @@ static void __init of_unittest_parse_interrupts_exte= nded(void) of_node_put(np); } =20 +#if IS_ENABLED(CONFIG_OF_DYNAMIC) +static void __init of_unittest_irq_refcount(void) +{ + struct of_phandle_args args; + struct device_node *intc0, *int_ext0; + unsigned int ref_c0, ref_c1, ref_c2; + int rc; + bool passed; + + if (of_irq_workarounds & OF_IMAP_OLDWORLD_MAC) + return; + + intc0 =3D of_find_node_by_path("/testcase-data/interrupts/intc0"); + int_ext0 =3D of_find_node_by_path("/testcase-data/interrupts/interrupts-e= xtended0"); + if (!intc0 || !int_ext0) { + pr_err("missing testcase data\n"); + goto out; + } + + /* Test refcount for API of_irq_parse_one() */ + passed =3D true; + ref_c0 =3D OF_KREF_READ(intc0); + ref_c1 =3D ref_c0 + 1; + memset(&args, 0, sizeof(args)); + rc =3D of_irq_parse_one(int_ext0, 0, &args); + ref_c2 =3D OF_KREF_READ(intc0); + of_node_put(args.np); + + passed &=3D !rc; + passed &=3D (args.np =3D=3D intc0); + passed &=3D (args.args_count =3D=3D 1); + passed &=3D (args.args[0] =3D=3D 1); + passed &=3D (ref_c1 =3D=3D ref_c2); + unittest(passed, "IRQ refcount case #1 failed, original(%u) expected(%u) = got(%u)\n", + ref_c0, ref_c1, ref_c2); + +out: + of_node_put(int_ext0); + of_node_put(intc0); +} +#else +static inline void __init of_unittest_irq_refcount(void) { } +#endif + static const struct of_device_id match_node_table[] =3D { { .data =3D "A", .name =3D "name0", }, /* Name alone is lowest priority */ { .data =3D "B", .type =3D "type1", }, /* followed by type alone */ @@ -4324,6 +4368,7 @@ static int __init of_unittest(void) of_unittest_changeset_prop(); of_unittest_parse_interrupts(); of_unittest_parse_interrupts_extended(); + of_unittest_irq_refcount(); of_unittest_dma_get_max_cpu_address(); of_unittest_parse_dma_ranges(); of_unittest_pci_dma_ranges(); --=20 2.34.1 From nobody Tue Dec 16 14:25:04 2025 Received: from pv50p00im-ztdg10021101.me.com (pv50p00im-ztdg10021101.me.com [17.58.6.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BDD761BC065 for ; Sun, 9 Feb 2025 12:59:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=17.58.6.44 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739105993; cv=none; b=Oww2PVCavGay8u8ha6zGFIhBkzViKZ2fuIbjrpFDdbFnSy4dQ6+GnaO+fFOOsyzjw73bNdvYJk31KoC1gCLhwhvt4S494UB0QG2zlDxnnCZunJtf39BqFhlws4xoXvVlMlcIGaZycoY/YtEo/+ZB0xaOxT/LI8JbN10Vwsb10FI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739105993; c=relaxed/simple; bh=P/GKa9XPQmJ9CzB1PYwPVCJdEP77JN+cmJ6yfUob4OQ=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Yx5EDmi9pdF5cdecHl1yWaZ2Xg3U2ujspdtejrPrzv/1EpZwTG07qn4NmmErI3c8wg1xGmaqPIgPHZlCNDz/xmtQSmBvtnXo1W65snECRaDn956I4D+Vnsk6xNpba0ytlB+UlvJNHegzg8mjRGjoCmyA+VbGaC2simAud9EFniw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com; spf=pass smtp.mailfrom=icloud.com; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b=FmUaeKKL; arc=none smtp.client-ip=17.58.6.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=icloud.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b="FmUaeKKL" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=icloud.com; s=1a1hai; bh=2XvnkI/Yi+2dOfaz2a2mLRPaawCsMazgnWp5isa+YrI=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:x-icloud-hme; b=FmUaeKKLdWUB4Gdihy9nJcfwtRI0P/ivjIQiZ5RczAM5C1Wb5IrP3YnuguN+PGmCi xbqPidYHFPC0qgXKlrqzXMkbPySQ6ypxkLg2sej3pjtxu2taU7DfFqCziDDehPovaG ENOldRpQyL/DnkMV7ZMvrCYneppc+XvtFSxLvlDHHjZWg2ivH5+PHD06odGUiEMXjD wG9jNy5EX2uEtIrU8RkcV5+inuJoiEJklZWVXIML4qg05NC7fU53LcVdUIXWogGRwv njdyGmKRWV2gy4WPGpYSgtHx64ADLUEZggOCJrZ/sFlTbAALP13kPg6S61U39mk2WZ NN+8O0GH43Tlg== Received: from [192.168.1.26] (pv50p00im-dlb-asmtp-mailmevip.me.com [17.56.9.10]) by pv50p00im-ztdg10021101.me.com (Postfix) with ESMTPSA id C9848D0009F; Sun, 9 Feb 2025 12:59:44 +0000 (UTC) From: Zijun Hu Date: Sun, 09 Feb 2025 20:58:55 +0800 Subject: [PATCH v2 2/9] of/irq: Fix device node refcount leakage in API of_irq_parse_one() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20250209-of_irq_fix-v2-2-93e3a2659aa7@quicinc.com> References: <20250209-of_irq_fix-v2-0-93e3a2659aa7@quicinc.com> In-Reply-To: <20250209-of_irq_fix-v2-0-93e3a2659aa7@quicinc.com> To: Rob Herring , Saravana Kannan , Lorenzo Pieralisi , Bjorn Helgaas , Marc Zyngier , Stefan Wiehler , Tony Lindgren , Thierry Reding , Benjamin Herrenschmidt , Julia Lawall Cc: Zijun Hu , devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, Zijun Hu , stable@vger.kernel.org X-Mailer: b4 0.14.2 X-Proofpoint-GUID: v-z9xPlaQQ-b5vtzxHURutqMStbFm-Cg X-Proofpoint-ORIG-GUID: v-z9xPlaQQ-b5vtzxHURutqMStbFm-Cg X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1057,Hydra:6.0.680,FMLib:17.12.68.34 definitions=2025-02-09_05,2025-02-07_03,2024-11-22_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 malwarescore=0 mlxlogscore=802 phishscore=0 mlxscore=0 clxscore=1015 suspectscore=0 bulkscore=0 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2308100000 definitions=main-2502090115 X-Apple-Remote-Links: v=1;h=KCk=;charset=UTF-8 From: Zijun Hu of_irq_parse_one(@int_gen_dev, i, ...) will leak refcount of @i_th_phandle int_gen_dev { ... interrupts-extended =3D ..., <&i_th_phandle ...>, ...; ... }; Refcount of @i_th_phandle is increased by of_parse_phandle_with_args() but is not decreased by API of_irq_parse_one() before return, so causes refcount leakage. Fix by putting the node's refcount before return as the other branch does. Also add comments about refcount of node @out_irq->np got by the API. Fixes: 79d9701559a9 ("of/irq: create interrupts-extended property") Cc: stable@vger.kernel.org Signed-off-by: Zijun Hu --- drivers/of/irq.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/of/irq.c b/drivers/of/irq.c index 6c843d54ebb116132144e6300d6d7ce94e763cf8..d88719c316a3931502c34a65b2d= b8921f7528d99 100644 --- a/drivers/of/irq.c +++ b/drivers/of/irq.c @@ -339,6 +339,8 @@ EXPORT_SYMBOL_GPL(of_irq_parse_raw); * This function resolves an interrupt for a node by walking the interrupt= tree, * finding which interrupt controller node it is attached to, and returnin= g the * interrupt specifier that can be used to retrieve a Linux IRQ number. + * + * Note: refcount of node @out_irq->np is increased by 1 on success. */ int of_irq_parse_one(struct device_node *device, int index, struct of_phan= dle_args *out_irq) { @@ -367,8 +369,11 @@ int of_irq_parse_one(struct device_node *device, int i= ndex, struct of_phandle_ar /* Try the new-style interrupts-extended first */ res =3D of_parse_phandle_with_args(device, "interrupts-extended", "#interrupt-cells", index, out_irq); - if (!res) - return of_irq_parse_raw(addr_buf, out_irq); + if (!res) { + p =3D out_irq->np; + res =3D of_irq_parse_raw(addr_buf, out_irq); + goto out; + } =20 /* Look for the interrupt parent. */ p =3D of_irq_find_parent(device); --=20 2.34.1 From nobody Tue Dec 16 14:25:04 2025 Received: from pv50p00im-ztdg10021101.me.com (pv50p00im-ztdg10021101.me.com [17.58.6.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 80FA91DED4B for ; Sun, 9 Feb 2025 12:59:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=17.58.6.44 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739105998; cv=none; b=rOgUH5XMRsMleQe/2fd8hIX311i7+rOOGwuhYclzEGNBn32pM8DeSw9yVH2T91yhhTYo4HhTKXJDVGiWaZb3xJTXYQfaPHrUk5PQRoaV0Gg/gAvc0Ask7ITx5hutAnQcloOt4kMO398xsWi0klvfgFMM6cfZ/Eijhu+dOYIz2n4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739105998; c=relaxed/simple; bh=0aCwt7elpHi7M64sqIBz/0dFie5skxQUze/5Nt0qt+Q=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=KrW2M8h6D+JE+qIlWrGBm+eCuedtWXsoawdUNQ/vX9/crkvDgAbnZ9eQ9FEYfSPztbPye3AvcxpbzS/ZI93KZn7M/eBNQ3oOtFdhSxihFcAjphLDtWsIU7k2gQvpHjxttxnIERWNpt+STnYtQLGrMJdhygJ2jIQHfelWGtlFKB0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com; spf=pass smtp.mailfrom=icloud.com; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b=UyHE03fA; arc=none smtp.client-ip=17.58.6.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=icloud.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b="UyHE03fA" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=icloud.com; s=1a1hai; bh=P499tSrXCSXauiyeO8bqq59+i6/Wf1NjTlpVK9TVwxs=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:x-icloud-hme; b=UyHE03fAg4FMLx+03ZJUgfyeSTAE24mUurXMKaRY3as4KhO2BqjDKW5iK7Kh4FbbF GicWR5x1dkm7Z3DxYfkqXqBWLdreZMx0FcyA9iUgQBwqcDQ0rrcV0NvBWBg6IK7Ts6 ix0mjzml8kEKGOJh1Dh3r5rbOMQZh4utdY6EKG3SiOCeUuRaK2pwjeFkCQ6kDLcAx8 8Qkj55K9/f3uR/85jxsmEfjUmlgqhl/4biKRKpdLjn6JexLxrK7K5L9Cue3QAz1qAL 5FJJK+ux9GVXrM2n3zEJ2jKfwTdC5P7l2uzcCkALKuDL1HUOd4WyixoRHdvo/EIPaM H5w47wI1IiMAQ== Received: from [192.168.1.26] (pv50p00im-dlb-asmtp-mailmevip.me.com [17.56.9.10]) by pv50p00im-ztdg10021101.me.com (Postfix) with ESMTPSA id E9D6CD00249; Sun, 9 Feb 2025 12:59:51 +0000 (UTC) From: Zijun Hu Date: Sun, 09 Feb 2025 20:58:56 +0800 Subject: [PATCH v2 3/9] of: unittest: Add a case to test if API of_irq_parse_raw() leaks refcount Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20250209-of_irq_fix-v2-3-93e3a2659aa7@quicinc.com> References: <20250209-of_irq_fix-v2-0-93e3a2659aa7@quicinc.com> In-Reply-To: <20250209-of_irq_fix-v2-0-93e3a2659aa7@quicinc.com> To: Rob Herring , Saravana Kannan , Lorenzo Pieralisi , Bjorn Helgaas , Marc Zyngier , Stefan Wiehler , Tony Lindgren , Thierry Reding , Benjamin Herrenschmidt , Julia Lawall Cc: Zijun Hu , devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, Zijun Hu X-Mailer: b4 0.14.2 X-Proofpoint-GUID: 25BJ4EESskLyH2hYdJYmWgnwlj8QIaK4 X-Proofpoint-ORIG-GUID: 25BJ4EESskLyH2hYdJYmWgnwlj8QIaK4 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1057,Hydra:6.0.680,FMLib:17.12.68.34 definitions=2025-02-09_05,2025-02-07_03,2024-11-22_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 malwarescore=0 mlxlogscore=999 phishscore=0 mlxscore=0 clxscore=1015 suspectscore=0 bulkscore=0 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2308100000 definitions=main-2502090115 X-Apple-Remote-Links: v=1;h=KCk=;charset=UTF-8 From: Zijun Hu To test if of_irq_parse_raw(), invoked by of_irq_parse_one(), will leak refcount of interrupt combo node consisting of controller and nexus. Signed-off-by: Zijun Hu --- drivers/of/unittest-data/tests-interrupts.dtsi | 13 +++++++++++++ drivers/of/unittest.c | 24 ++++++++++++++++++++++= +- 2 files changed, 36 insertions(+), 1 deletion(-) diff --git a/drivers/of/unittest-data/tests-interrupts.dtsi b/drivers/of/un= ittest-data/tests-interrupts.dtsi index 7c9f31cc131bae79ed81a1654cfc564e9c85bf9d..4ccb54f91c3068c0857f461fea0= cf465aa0e2633 100644 --- a/drivers/of/unittest-data/tests-interrupts.dtsi +++ b/drivers/of/unittest-data/tests-interrupts.dtsi @@ -50,6 +50,13 @@ test_intmap1: intmap1 { interrupt-map =3D <0x5000 1 2 &test_intc0 15>; }; =20 + test_intc_intmap0: intc-intmap0 { + #interrupt-cells =3D <1>; + #address-cells =3D <1>; + interrupt-controller; + interrupt-map =3D <0x6000 1 &test_intc_intmap0 0x7000 2>; + }; + interrupts0 { interrupt-parent =3D <&test_intc0>; interrupts =3D <1>, <2>, <3>, <4>; @@ -60,6 +67,12 @@ interrupts1 { interrupts =3D <1>, <2>, <3>, <4>; }; =20 + interrupts2 { + reg =3D <0x6000 0x100>; + interrupt-parent =3D <&test_intc_intmap0>; + interrupts =3D <1>; + }; + interrupts-extended0 { reg =3D <0x5000 0x100>; /* diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c index 48aec4695fff647226697fefcae696adaa307480..64d301893af7b861cf3e3c25d10= f943dfd92bc03 100644 --- a/drivers/of/unittest.c +++ b/drivers/of/unittest.c @@ -1659,6 +1659,7 @@ static void __init of_unittest_irq_refcount(void) { struct of_phandle_args args; struct device_node *intc0, *int_ext0; + struct device_node *int2, *intc_intmap0; unsigned int ref_c0, ref_c1, ref_c2; int rc; bool passed; @@ -1668,7 +1669,9 @@ static void __init of_unittest_irq_refcount(void) =20 intc0 =3D of_find_node_by_path("/testcase-data/interrupts/intc0"); int_ext0 =3D of_find_node_by_path("/testcase-data/interrupts/interrupts-e= xtended0"); - if (!intc0 || !int_ext0) { + intc_intmap0 =3D of_find_node_by_path("/testcase-data/interrupts/intc-int= map0"); + int2 =3D of_find_node_by_path("/testcase-data/interrupts/interrupts2"); + if (!intc0 || !int_ext0 || !intc_intmap0 || !int2) { pr_err("missing testcase data\n"); goto out; } @@ -1690,7 +1693,26 @@ static void __init of_unittest_irq_refcount(void) unittest(passed, "IRQ refcount case #1 failed, original(%u) expected(%u) = got(%u)\n", ref_c0, ref_c1, ref_c2); =20 + /* Test refcount for API of_irq_parse_raw() */ + passed =3D true; + ref_c0 =3D OF_KREF_READ(intc_intmap0); + ref_c1 =3D ref_c0 + 1; + memset(&args, 0, sizeof(args)); + rc =3D of_irq_parse_one(int2, 0, &args); + ref_c2 =3D OF_KREF_READ(intc_intmap0); + of_node_put(args.np); + + passed &=3D !rc; + passed &=3D (args.np =3D=3D intc_intmap0); + passed &=3D (args.args_count =3D=3D 1); + passed &=3D (args.args[0] =3D=3D 2); + passed &=3D (ref_c1 =3D=3D ref_c2); + unittest(passed, "IRQ refcount case #2 failed, original(%u) expected(%u) = got(%u)\n", + ref_c0, ref_c1, ref_c2); + out: + of_node_put(int2); + of_node_put(intc_intmap0); of_node_put(int_ext0); of_node_put(intc0); } --=20 2.34.1 From nobody Tue Dec 16 14:25:04 2025 Received: from pv50p00im-ztdg10021101.me.com (pv50p00im-ztdg10021101.me.com [17.58.6.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 438791DF25E for ; Sun, 9 Feb 2025 13:00:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=17.58.6.44 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739106005; cv=none; b=hn1Sls4oNXMyKO3YCgteWZsHFHT+yry0PQIQhN2Y6BrxKuj5WTaZWMwb2MvAAtj6n753Ob5CC0ceSRMYFNo0ZjnPVdDxhzVFxd9pfs1WZtaknAhrPZ6/8p28RKAfS7S21/doDRyKxBZbP462fpLLnmUdmiQCTSPK9XbABA45nq8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739106005; c=relaxed/simple; bh=Q5zYpA6MMblmxx1N4pC32MnpIHX9rVeXAYy1yHACddw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Ukz2gOJ/orwplGlk44QrOSWZl47SNUCw2mM32ZrRysmTbI6sJ+gz0S8MHKevNHJpVYtQwI7CJkjqGMAP7vIQa1Q/shuVaFvtwRpKWDQ8TYUY+wBBV9lgbQtJyohOqWGKGeDa0ItSmYqgqIi9kNxyywNwx4Z/6j17C8OcuKSMK0g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com; spf=pass smtp.mailfrom=icloud.com; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b=lC6sddJN; arc=none smtp.client-ip=17.58.6.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=icloud.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b="lC6sddJN" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=icloud.com; s=1a1hai; bh=0MsUKzM4+9jzZuP5RCheexLjc9MTlK8C67KDQoaDPGA=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:x-icloud-hme; b=lC6sddJNsLWLLTHMCxRknU4DNmJG/IZl1+12CuY+Tg3kHeiAPIoHT/B/ouluuY8hP Ist5PUGxxCSKCzZMpjCOtAANDRb2CcCvuni1nc3co9qETEMoKen6jZVoTuKAqY1SBq XOh7xG/KCeLV7AJTR8x4W8Ggz0jJ4g3zuXaePfIgEwGUD1QsQqkEP14DGdgVJnRo+u 9c68eappdqC5TZex+qiR6zLynp+2HMkGHcoDhFJsQcsHdMY2NYLNuXNFBafS+zpcoV H6yhglZzci1btrUeaL9UADlRWi5ufaImhfOLsblX2brWobTH8KJQ9vLlDTuixUpofJ 8f9It7D3ZVmVg== Received: from [192.168.1.26] (pv50p00im-dlb-asmtp-mailmevip.me.com [17.56.9.10]) by pv50p00im-ztdg10021101.me.com (Postfix) with ESMTPSA id E4A1AD00283; Sun, 9 Feb 2025 12:59:57 +0000 (UTC) From: Zijun Hu Date: Sun, 09 Feb 2025 20:58:57 +0800 Subject: [PATCH v2 4/9] of/irq: Fix device node refcount leakage in API of_irq_parse_raw() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20250209-of_irq_fix-v2-4-93e3a2659aa7@quicinc.com> References: <20250209-of_irq_fix-v2-0-93e3a2659aa7@quicinc.com> In-Reply-To: <20250209-of_irq_fix-v2-0-93e3a2659aa7@quicinc.com> To: Rob Herring , Saravana Kannan , Lorenzo Pieralisi , Bjorn Helgaas , Marc Zyngier , Stefan Wiehler , Tony Lindgren , Thierry Reding , Benjamin Herrenschmidt , Julia Lawall Cc: Zijun Hu , devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, Zijun Hu , stable@vger.kernel.org X-Mailer: b4 0.14.2 X-Proofpoint-GUID: DRDRBEPa6Ogb6JQzQwWYpA9GOMLbYtEF X-Proofpoint-ORIG-GUID: DRDRBEPa6Ogb6JQzQwWYpA9GOMLbYtEF X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1057,Hydra:6.0.680,FMLib:17.12.68.34 definitions=2025-02-09_05,2025-02-07_03,2024-11-22_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 malwarescore=0 mlxlogscore=967 phishscore=0 mlxscore=0 clxscore=1015 suspectscore=0 bulkscore=0 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2308100000 definitions=main-2502090115 X-Apple-Remote-Links: v=1;h=KCk=;charset=UTF-8 From: Zijun Hu if the node @out_irq->np got by of_irq_parse_raw() is a combo node which consists of both controller and nexus, namely, of_irq_parse_raw() returns due to condition (@ipar =3D=3D @newpar), then the node's refcount was incre= ased twice, hence causes refcount leakage. Fix by putting @out_irq->np refcount before returning due to the condition. Also add comments about refcount of node @out_irq->np got by the API. Fixes: 041284181226 ("of/irq: Allow matching of an interrupt-map local to a= n interrupt controller") Cc: stable@vger.kernel.org Signed-off-by: Zijun Hu --- drivers/of/irq.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/of/irq.c b/drivers/of/irq.c index d88719c316a3931502c34a65b2db8921f7528d99..c41b2533d86d8eceabe8f2e4384= 2af33f22febff 100644 --- a/drivers/of/irq.c +++ b/drivers/of/irq.c @@ -165,6 +165,8 @@ const __be32 *of_irq_parse_imap_parent(const __be32 *im= ap, int len, struct of_ph * the specifier for each map, and then returns the translated map. * * Return: 0 on success and a negative number on error + * + * Note: refcount of node @out_irq->np is increased by 1 on success. */ int of_irq_parse_raw(const __be32 *addr, struct of_phandle_args *out_irq) { @@ -310,6 +312,12 @@ int of_irq_parse_raw(const __be32 *addr, struct of_pha= ndle_args *out_irq) addrsize =3D (imap - match_array) - intsize; =20 if (ipar =3D=3D newpar) { + /* + * Has got @ipar's refcount, but the refcount was + * got again by of_irq_parse_imap_parent() via its + * alias @newpair. + */ + of_node_put(ipar); pr_debug("%pOF interrupt-map entry to self\n", ipar); return 0; } --=20 2.34.1 From nobody Tue Dec 16 14:25:04 2025 Received: from pv50p00im-ztdg10021101.me.com (pv50p00im-ztdg10021101.me.com [17.58.6.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2EFF51DE2A6 for ; Sun, 9 Feb 2025 13:00:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=17.58.6.44 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739106011; cv=none; b=h5on+3KwxvP9ekRh2UJN+N5mMwofNivCpoiLMgB75huySJUYqh79QcRdBi31utXnekLN8sbn7/okCdtGUKJKHRO6drAW3UKRId07yatP+AllPOBi3JevUG3N5vNhdJ7I9P2Fz5Qufx/yXuChhU1P6wQBR1HXj7hSgZ6CGqS/7+o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739106011; c=relaxed/simple; bh=llyBk/D8rlTHUuJeik+MIK2sfdpXFGludODcjcY3fB0=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=nLrtgWGd2bLbvgzsPxpJVJ5L0/BM3+aUehM/go9BeWVpWUyQCfNmKsFt105FzJ5G+KGico6AkTQnaat0zG8GuneQkvCj8/3TvkSm0FNnVDk6kGN33pd94rk4+bet3udx8vySKm0zQ6fw8mNfVWhMhV6E4yk8Rs0TzUoHG3Wedus= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com; spf=pass smtp.mailfrom=icloud.com; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b=hXFw7TLa; arc=none smtp.client-ip=17.58.6.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=icloud.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b="hXFw7TLa" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=icloud.com; s=1a1hai; bh=XIMc4+bWC8JFaNsl7WhlNT4TkWv3ENHhYxdQbR71LKs=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:x-icloud-hme; b=hXFw7TLaS9AVUe1ipjkyhalnEqaNy2C5TxT/4cBZUkAT87UrqY2agnw1bV2VMpajL 3O6Bc99Z0/jnS/HSJLL9RMSIK62GakKmc8ryFP82IyWEBOekjgrhn1kTzdadob6yUa W4/CzaArTuHUUxLihdQOEMer2fPmO7tyYbmhPFNc0GBaq08eiokRj2t/rRCItZ0iqZ kVyHHbdLkbPfLanz+PUTjLGo32EcdzhHDydrQEwFgy3iDSVhXuUXho66i83nCoy+41 BEi4ZGiEnr1NEqkq7uR64vX4lUdKsELpKTZ9AVSVVq4rZ+R71E7ff0oymQtfSo8uzB 5jgtOZ7Ik+DFQ== Received: from [192.168.1.26] (pv50p00im-dlb-asmtp-mailmevip.me.com [17.56.9.10]) by pv50p00im-ztdg10021101.me.com (Postfix) with ESMTPSA id 678FAD00277; Sun, 9 Feb 2025 13:00:04 +0000 (UTC) From: Zijun Hu Date: Sun, 09 Feb 2025 20:58:58 +0800 Subject: [PATCH v2 5/9] of/irq: Fix device node refcount leakages in of_irq_count() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20250209-of_irq_fix-v2-5-93e3a2659aa7@quicinc.com> References: <20250209-of_irq_fix-v2-0-93e3a2659aa7@quicinc.com> In-Reply-To: <20250209-of_irq_fix-v2-0-93e3a2659aa7@quicinc.com> To: Rob Herring , Saravana Kannan , Lorenzo Pieralisi , Bjorn Helgaas , Marc Zyngier , Stefan Wiehler , Tony Lindgren , Thierry Reding , Benjamin Herrenschmidt , Julia Lawall Cc: Zijun Hu , devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, Zijun Hu , stable@vger.kernel.org X-Mailer: b4 0.14.2 X-Proofpoint-GUID: 6HB4iw6BgEMLlIYIjFQZlNYzx77Mfx8v X-Proofpoint-ORIG-GUID: 6HB4iw6BgEMLlIYIjFQZlNYzx77Mfx8v X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1057,Hydra:6.0.680,FMLib:17.12.68.34 definitions=2025-02-09_05,2025-02-07_03,2024-11-22_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 malwarescore=0 mlxlogscore=835 phishscore=0 mlxscore=0 clxscore=1015 suspectscore=0 bulkscore=0 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2308100000 definitions=main-2502090115 X-Apple-Remote-Links: v=1;h=KCk=;charset=UTF-8 From: Zijun Hu of_irq_count() invokes of_irq_parse_one() to count IRQs, and successful invocation of the later will get device node @irq.np refcount, but the former does not put the refcount before next iteration invocation, hence causes device node refcount leakages. Fix by putting @irq.np refcount before the next iteration invocation. Fixes: 3da5278727a8 ("of/irq: Rework of_irq_count()") Cc: stable@vger.kernel.org Signed-off-by: Zijun Hu --- drivers/of/irq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/of/irq.c b/drivers/of/irq.c index c41b2533d86d8eceabe8f2e43842af33f22febff..95a482a584740c3a0f55b791157= 072166dffffe0 100644 --- a/drivers/of/irq.c +++ b/drivers/of/irq.c @@ -518,8 +518,10 @@ int of_irq_count(struct device_node *dev) struct of_phandle_args irq; int nr =3D 0; =20 - while (of_irq_parse_one(dev, nr, &irq) =3D=3D 0) + while (of_irq_parse_one(dev, nr, &irq) =3D=3D 0) { + of_node_put(irq.np); nr++; + } =20 return nr; } --=20 2.34.1 From nobody Tue Dec 16 14:25:04 2025 Received: from pv50p00im-ztdg10021101.me.com (pv50p00im-ztdg10021101.me.com [17.58.6.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CA2AA1DE892 for ; Sun, 9 Feb 2025 13:00:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=17.58.6.44 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739106018; cv=none; b=ej9lwKzoHp8R3JG5kC0t5B33iu67LVHZir20jU5aA/iwg17PwWjm9RViAHgMgWkWmZQp/emhkW6fWcwqgVzf+66KSgaJTbTZczy9h5NZCmBntl04JPEcdkJ/p1vtytZCN0ra1OCaugC5Hm/qsegxhsTurIxV6uafmXKqvsrImUw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739106018; c=relaxed/simple; bh=OqfLLryDTrYu+I1LVEjY9wnlgXFaiDs1ypiygpWGReE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=WMp4j7fKsAVdVhNBheR6P98GPIZ/D+Lcinfy3CV6hHK+ESyeabCJM4yGn8a43NuScvwBleKTpwSjd24de45aWq7trPMv03QQ4LKD6cEZ2avVgEEABqull4zoHxeI6KrnJyWDQPtvCbZNPWWwyQRj7waY2Lr93Yl7DPsQN6yUocI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com; spf=pass smtp.mailfrom=icloud.com; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b=hyvvx8lH; arc=none smtp.client-ip=17.58.6.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=icloud.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b="hyvvx8lH" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=icloud.com; s=1a1hai; bh=itBy9qCxfeKAmoPColawX+1dT3mRAnFnFY5Z861wbMo=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:x-icloud-hme; b=hyvvx8lHhV5MSXhjHTDoUjkEqSuRV7lrb49V2vq0T/L0SR851hMQvlkvqt+vD6A8T lRFBtXqGPEuUENAtficg9ApALD4jwouacIKS0GnmdsPMQUGmKgsTfcJ27My8EJh1ij QhzsEfGMM5RD/taPaOwepJoJ+b056GCCOzQ+kiD1WiBgFbVVGJhIxPDYQq2g0eE7RJ xpb3uEvS++ytgXCpHj/Fy8ivlbvZ1/f8L0+aXFwLOb29ipP9XVyhbYf+tK2Uo/Anyz rROdjfWEy9/wVLYfWaA1gQVRnI/lyjgoKYs+nHibyQS4CWl+uZRIVaz6fouHx5VHZG Ey5xG3RvHKKSg== Received: from [192.168.1.26] (pv50p00im-dlb-asmtp-mailmevip.me.com [17.56.9.10]) by pv50p00im-ztdg10021101.me.com (Postfix) with ESMTPSA id 8803BD0008A; Sun, 9 Feb 2025 13:00:10 +0000 (UTC) From: Zijun Hu Date: Sun, 09 Feb 2025 20:58:59 +0800 Subject: [PATCH v2 6/9] of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20250209-of_irq_fix-v2-6-93e3a2659aa7@quicinc.com> References: <20250209-of_irq_fix-v2-0-93e3a2659aa7@quicinc.com> In-Reply-To: <20250209-of_irq_fix-v2-0-93e3a2659aa7@quicinc.com> To: Rob Herring , Saravana Kannan , Lorenzo Pieralisi , Bjorn Helgaas , Marc Zyngier , Stefan Wiehler , Tony Lindgren , Thierry Reding , Benjamin Herrenschmidt , Julia Lawall Cc: Zijun Hu , devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, Zijun Hu , stable@vger.kernel.org X-Mailer: b4 0.14.2 X-Proofpoint-GUID: Oj71nTUld6c26RoWbQHJnJM822Ci5Lbk X-Proofpoint-ORIG-GUID: Oj71nTUld6c26RoWbQHJnJM822Ci5Lbk X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1057,Hydra:6.0.680,FMLib:17.12.68.34 definitions=2025-02-09_05,2025-02-07_03,2024-11-22_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 malwarescore=0 mlxlogscore=934 phishscore=0 mlxscore=0 clxscore=1015 suspectscore=0 bulkscore=0 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2308100000 definitions=main-2502090115 X-Apple-Remote-Links: v=1;h=KCk=;charset=UTF-8 From: Zijun Hu In irq_of_parse_and_map(), refcount of device node @oirq.np was got by successful of_irq_parse_one() invocation, but it does not put the refcount before return, so causes @oirq.np refcount leakage. Fix by putting @oirq.np refcount before return. Fixes: e3873444990d ("of/irq: Move irq_of_parse_and_map() to common code") Cc: stable@vger.kernel.org Signed-off-by: Zijun Hu --- drivers/of/irq.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/of/irq.c b/drivers/of/irq.c index 95a482a584740c3a0f55b791157072166dffffe0..064db004eea5129efb7d267abf7= c1133c9a76e26 100644 --- a/drivers/of/irq.c +++ b/drivers/of/irq.c @@ -38,11 +38,15 @@ unsigned int irq_of_parse_and_map(struct device_node *dev, int index) { struct of_phandle_args oirq; + unsigned int ret; =20 if (of_irq_parse_one(dev, index, &oirq)) return 0; =20 - return irq_create_of_mapping(&oirq); + ret =3D irq_create_of_mapping(&oirq); + of_node_put(oirq.np); + + return ret; } EXPORT_SYMBOL_GPL(irq_of_parse_and_map); =20 --=20 2.34.1 From nobody Tue Dec 16 14:25:04 2025 Received: from pv50p00im-ztdg10021101.me.com (pv50p00im-ztdg10021101.me.com [17.58.6.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 391691DE892 for ; Sun, 9 Feb 2025 13:00:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=17.58.6.44 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739106024; cv=none; b=WQRYzEgAQXQ0CabutcSPVT0xfuD0mnlr9uHge5n1ikXwlqgLym2QbjWQw+r+s0o7D9v8u6LoKxInc7VNLe9cwhAXBtwhpggMwvofRA8nxmRLoCL87hkCAha7YgIh7An1O9NiBTFlKcCLo20NUl8VajqO34XjbdW2MsYQMWwZxJs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739106024; c=relaxed/simple; bh=C3QWRS/oyMBoQil6zUy6RcS/RNrduorE/fP1oykD4WY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=NBCYzWXiVonQbVVBETaPyxb2yYW0FsEojUfIBRKkR23V9ZBxL2nF9b7iiaHcpsfCAwcqDMiNtSfPqaevvE9H8XaHfvtb5NmCELclUtTe8eluKNipXJXHrfz7K40HXX1UNz4Ij6D0pyfKOJ91cI32U66Jg+iO4VjAfJk/poEK38g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com; spf=pass smtp.mailfrom=icloud.com; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b=lHGzDr5U; arc=none smtp.client-ip=17.58.6.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=icloud.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b="lHGzDr5U" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=icloud.com; s=1a1hai; bh=HXqjFxnuLWVmTW2aVge3NLkwdNyGpwzPpwgyO1GtToQ=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:x-icloud-hme; b=lHGzDr5U94q+lOZD9JbG75DS8TMvvgK3SIGdsOoWCrvPd/pTgy01jsOQgSHDOMRWr TVvAD1yB/ZDEsAaxwAow0ojrJvsZhgNQ/SLJgUM4xEJBjfcCP9IlsAOFMMltqyXzLt Yu/wyj5wXYjocRNs0G3Q0kuk/ZEKPVLuEkb5kxU51fI5XLmjxKnJlhEyepRhRrXLDw 8Uku+oltlSwWo45O1VEa/776JzIeTr9F15kzCKLEe+C/z3t/V+3WaVRBV5nJah3yxl f3KVdR5IB1gtOu1xIwcabfw+sz3BDmBFECvWG6pXsl69DuwIs8FN85F46gZzj00O+e FqroA+EKaayiA== Received: from [192.168.1.26] (pv50p00im-dlb-asmtp-mailmevip.me.com [17.56.9.10]) by pv50p00im-ztdg10021101.me.com (Postfix) with ESMTPSA id 29BBFD001C8; Sun, 9 Feb 2025 13:00:16 +0000 (UTC) From: Zijun Hu Date: Sun, 09 Feb 2025 20:59:00 +0800 Subject: [PATCH v2 7/9] of/irq: Fix device node refcount leakages in of_irq_init() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20250209-of_irq_fix-v2-7-93e3a2659aa7@quicinc.com> References: <20250209-of_irq_fix-v2-0-93e3a2659aa7@quicinc.com> In-Reply-To: <20250209-of_irq_fix-v2-0-93e3a2659aa7@quicinc.com> To: Rob Herring , Saravana Kannan , Lorenzo Pieralisi , Bjorn Helgaas , Marc Zyngier , Stefan Wiehler , Tony Lindgren , Thierry Reding , Benjamin Herrenschmidt , Julia Lawall Cc: Zijun Hu , devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, Zijun Hu , stable@vger.kernel.org X-Mailer: b4 0.14.2 X-Proofpoint-GUID: LCp5ur5Xe8UoFB2O6wp0y7kzuK7eBYmF X-Proofpoint-ORIG-GUID: LCp5ur5Xe8UoFB2O6wp0y7kzuK7eBYmF X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1057,Hydra:6.0.680,FMLib:17.12.68.34 definitions=2025-02-09_05,2025-02-07_03,2024-11-22_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 malwarescore=0 mlxlogscore=999 phishscore=0 mlxscore=0 clxscore=1015 suspectscore=0 bulkscore=0 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2308100000 definitions=main-2502090115 X-Apple-Remote-Links: v=1;h=KCk=;charset=UTF-8 From: Zijun Hu of_irq_init() will leak interrupt controller device node refcounts in two places as explained below: 1) Leak refcounts of both @desc->dev and @desc->interrupt_parent when suffers @desc->irq_init_cb() failure. 2) Leak refcount of @desc->interrupt_parent when cleans up list @intc_desc_list in the end. Refcounts of both @desc->dev and @desc->interrupt_parent were got in the first loop, but of_irq_init() does not put them before kfree(@desc) in places mentioned above, so causes refcount leakages. Fix by putting refcounts involved before kfree(@desc). Fixes: 8363ccb917c6 ("of/irq: add missing of_node_put") Fixes: c71a54b08201 ("of/irq: introduce of_irq_init") Cc: stable@vger.kernel.org Signed-off-by: Zijun Hu --- drivers/of/irq.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/of/irq.c b/drivers/of/irq.c index 064db004eea5129efb7d267abf7c1133c9a76e26..ded2a18776671bb30b3c75367e0= 857494a5c8570 100644 --- a/drivers/of/irq.c +++ b/drivers/of/irq.c @@ -642,6 +642,8 @@ void __init of_irq_init(const struct of_device_id *matc= hes) __func__, desc->dev, desc->dev, desc->interrupt_parent); of_node_clear_flag(desc->dev, OF_POPULATED); + of_node_put(desc->interrupt_parent); + of_node_put(desc->dev); kfree(desc); continue; } @@ -672,6 +674,7 @@ void __init of_irq_init(const struct of_device_id *matc= hes) err: list_for_each_entry_safe(desc, temp_desc, &intc_desc_list, list) { list_del(&desc->list); + of_node_put(desc->interrupt_parent); of_node_put(desc->dev); kfree(desc); } --=20 2.34.1 From nobody Tue Dec 16 14:25:04 2025 Received: from pv50p00im-ztdg10021101.me.com (pv50p00im-ztdg10021101.me.com [17.58.6.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4628C1D6DB5 for ; Sun, 9 Feb 2025 13:00:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=17.58.6.44 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739106030; cv=none; b=b4rW3CFf4p62R0nLhi4fPb4/NfigrEu66pAuycgxIDO3CkwBpOKDuZGXc7dXHgq/5MovdF5RDZDY0yJ/zQAFZsH15xPjeN2cyXiUnntNE/NAVrd80zE0MaNJV46lVAPdXALPjA/HGN/J0uOfc0do3h1mIZPETIYfetXhW42hDc4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739106030; c=relaxed/simple; bh=LGxPN32FZV5puJ/82QGfCx5ohZJoHjfUizQCqjrtyt4=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=K4R8oZj38SPmkAw4M1VFzvXxxQ2ZoKd1jKSulrM5uDHYEJIEjik4/zMNpVH/jiT0bgqTT+9IvxX/NrzKLPKOaZglMtIn3fv0NNvBLZN3PwjXSuWmUl/dSCboqfbNPCA010pFLR+nOqnJ999pjcPF5DVjHFdAwYgmrr5Zx9JdCDM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com; spf=pass smtp.mailfrom=icloud.com; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b=TaXAX0Oj; arc=none smtp.client-ip=17.58.6.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=icloud.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b="TaXAX0Oj" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=icloud.com; s=1a1hai; bh=/WWMYR9GDJolz5esQMrY5S1Zc09zsLZyulks3hRVEVY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:x-icloud-hme; b=TaXAX0OjiZJhqrW3F9Chtt8+2jr9GkOOQ9tE3lzlrHN3yVhsQu4x+HyZai0bu0UZf PWRXjJ9ppOMwFXBX1N6DUk2ccJZxExHecphfuZW3JYu+K3UQnPEubfwY4jBAyuaAGE NJtjvmAasyKBHIKg4X85DbHlrC+//DxUFlLlo74vjp4RWu7SSGJKiXMA2Fz7S1dvd5 6W3p0SXkUhAE+XdY067P4F9r/BQASoj6b8ASTyIeJAjEkktEYknXb7J2dwuzN5Vhdm i+alP9M5Il5aAyFBnU+UqxF7sO2H/mMnSJltx9+fDRZBIt+qN52PbvubPJlwjX9N6Q 4CZJrFPgbZ9zw== Received: from [192.168.1.26] (pv50p00im-dlb-asmtp-mailmevip.me.com [17.56.9.10]) by pv50p00im-ztdg10021101.me.com (Postfix) with ESMTPSA id 686A3D0026A; Sun, 9 Feb 2025 13:00:23 +0000 (UTC) From: Zijun Hu Date: Sun, 09 Feb 2025 20:59:01 +0800 Subject: [PATCH v2 8/9] of/irq: Add comments about refcount for API of_irq_find_parent() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20250209-of_irq_fix-v2-8-93e3a2659aa7@quicinc.com> References: <20250209-of_irq_fix-v2-0-93e3a2659aa7@quicinc.com> In-Reply-To: <20250209-of_irq_fix-v2-0-93e3a2659aa7@quicinc.com> To: Rob Herring , Saravana Kannan , Lorenzo Pieralisi , Bjorn Helgaas , Marc Zyngier , Stefan Wiehler , Tony Lindgren , Thierry Reding , Benjamin Herrenschmidt , Julia Lawall Cc: Zijun Hu , devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, Zijun Hu X-Mailer: b4 0.14.2 X-Proofpoint-GUID: TysRMhn4wYspCWzierMrcaMBBl7Peobp X-Proofpoint-ORIG-GUID: TysRMhn4wYspCWzierMrcaMBBl7Peobp X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1057,Hydra:6.0.680,FMLib:17.12.68.34 definitions=2025-02-09_05,2025-02-07_03,2024-11-22_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 malwarescore=0 mlxlogscore=665 phishscore=0 mlxscore=0 clxscore=1015 suspectscore=0 bulkscore=0 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2308100000 definitions=main-2502090115 X-Apple-Remote-Links: v=1;h=KCk=;charset=UTF-8 From: Zijun Hu Add comments about refcount of the node returned by of_irq_find_parent(). Signed-off-by: Zijun Hu --- drivers/of/irq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/of/irq.c b/drivers/of/irq.c index ded2a18776671bb30b3c75367e0857494a5c8570..b947bee81434c5303d37555bada= 4564be01426ab 100644 --- a/drivers/of/irq.c +++ b/drivers/of/irq.c @@ -54,8 +54,8 @@ EXPORT_SYMBOL_GPL(irq_of_parse_and_map); * of_irq_find_parent - Given a device node, find its interrupt parent node * @child: pointer to device node * - * Return: A pointer to the interrupt parent node, or NULL if the interrupt - * parent could not be determined. + * Return: A pointer to the interrupt parent node with refcount increased + * or NULL if the interrupt parent could not be determined. */ struct device_node *of_irq_find_parent(struct device_node *child) { --=20 2.34.1 From nobody Tue Dec 16 14:25:04 2025 Received: from pv50p00im-ztdg10021101.me.com (pv50p00im-ztdg10021101.me.com [17.58.6.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1F4001D9595 for ; Sun, 9 Feb 2025 13:00:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=17.58.6.44 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739106056; cv=none; b=Srgraj7RKj7MjaOKXQ7XEhqIeZlh4Qjbaj5TlEt6kG9X2TKEC/NBTuZt7xJoacn+tbMBt1GY1D6iYgJXJPE1sNyo3bkBq//dySexSoackrcdnXo0ZVS7Wl2oMt96PUu5CiNlm6PSEtTaUJcC4HQLh2MLyq9+L5OVUqWBOn7alVE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739106056; c=relaxed/simple; bh=Xyffhkw9qVjtiT+ifySYWkBDJuug+7f9ej1i8+nxm94=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=u0FGkoyAFmUDWF0ycfy/puXzq8deKydiajEYBK4N1SsZt7BPwnQDYEsLFNiyAji3VhtT2K2mlGhDUlUyIErA6BkS4wNIANTsjcEEKGNsM70C9UAiSYcK9cWFghv7HfQG2nK4+iqM26xWjEqB+YjnK4fvi/6Ohqdxcz7Vyc45IKk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com; spf=pass smtp.mailfrom=icloud.com; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b=ni2PId0k; arc=none smtp.client-ip=17.58.6.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=icloud.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b="ni2PId0k" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=icloud.com; s=1a1hai; bh=ofZsMAmyfjKnHJmM1L8pFW96kyh2iTU8Cuekoza3vnU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:x-icloud-hme; b=ni2PId0kD2I+JGoKi+GflL6oUUGbcUK4hRZo1utpqhbELS5X4D9/+3/h4yiQPKfUB 9QoAB675ZX7cfzbbVYhDp0Uus51WOBX6zb9JUG4dod/xvP2MI9dNuDNlvD6quRSifY +HKuSvOp56N4ndRJ35InLV/DHxJ5HgjGIc3o+CAcr7LIUHkKjxorKEYgESWWpD/KLl 0y7O7RsEAH6Jro1mGM6JM0wsSnA8yPUY9jX0fZUG10E8I4dgNQrRYlm9Z4FGRmc4lC Q5/N3sNS7leXC9W9e371mYTjfViGF3K2epKJV93IfsnFskWAFjl3RaK3baj0DjatdU Cvsc06thtFing== Received: from [192.168.1.26] (pv50p00im-dlb-asmtp-mailmevip.me.com [17.56.9.10]) by pv50p00im-ztdg10021101.me.com (Postfix) with ESMTPSA id 12580D002C3; Sun, 9 Feb 2025 13:00:29 +0000 (UTC) From: Zijun Hu Date: Sun, 09 Feb 2025 20:59:02 +0800 Subject: [PATCH v2 9/9] of: resolver: Fix device node refcount leakage in of_resolve_phandles() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20250209-of_irq_fix-v2-9-93e3a2659aa7@quicinc.com> References: <20250209-of_irq_fix-v2-0-93e3a2659aa7@quicinc.com> In-Reply-To: <20250209-of_irq_fix-v2-0-93e3a2659aa7@quicinc.com> To: Rob Herring , Saravana Kannan , Lorenzo Pieralisi , Bjorn Helgaas , Marc Zyngier , Stefan Wiehler , Tony Lindgren , Thierry Reding , Benjamin Herrenschmidt , Julia Lawall Cc: Zijun Hu , devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, Zijun Hu , stable@vger.kernel.org X-Mailer: b4 0.14.2 X-Proofpoint-GUID: 44BrMHfmuQSbv_XCfJBl-CKTW9nR2hTC X-Proofpoint-ORIG-GUID: 44BrMHfmuQSbv_XCfJBl-CKTW9nR2hTC X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1057,Hydra:6.0.680,FMLib:17.12.68.34 definitions=2025-02-09_05,2025-02-07_03,2024-11-22_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 malwarescore=0 mlxlogscore=809 phishscore=0 mlxscore=0 clxscore=1015 suspectscore=0 bulkscore=0 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2308100000 definitions=main-2502090116 X-Apple-Remote-Links: v=1;h=KCk=;charset=UTF-8 From: Zijun Hu In of_resolve_phandles(), refcount of device node @local_fixups will be increased if the for_each_child_of_node() exits early, but nowhere to decrease the refcount, so cause refcount leakage for the node. Fix by adding of_node_put(@local_fixups) before return. Fixes: da56d04c806a ("of/resolver: Switch to new local fixups format.") Cc: stable@vger.kernel.org Signed-off-by: Zijun Hu --- drivers/of/resolver.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/of/resolver.c b/drivers/of/resolver.c index 779db058c42f5b8198ee3417dfaab80c81b43e4c..b589e59667fd3ea2c2bd5240414= 803cb17707ec9 100644 --- a/drivers/of/resolver.c +++ b/drivers/of/resolver.c @@ -256,6 +256,7 @@ int of_resolve_phandles(struct device_node *overlay) phandle phandle, phandle_delta; int err; =20 + local_fixups =3D NULL; tree_symbols =3D NULL; =20 if (!overlay) { @@ -332,6 +333,7 @@ int of_resolve_phandles(struct device_node *overlay) if (err) pr_err("overlay phandle fixup failed: %d\n", err); of_node_put(tree_symbols); + of_node_put(local_fixups); =20 return err; } --=20 2.34.1