Hi,

This patchset fixes a potential memory leak in the error path of
build_tree(), reported by Abdun Nihaal[1].

The first two patches refactor build tree() to optimize port counting and
the place of parent port validation. The last patch fixes the error path
to release allocated node instances properly.

The changes were verified using the kmem:kmalloc and kmem:kfree
tracepoints together with the KUnit tests added in my former patchset[2].
The kmem:kfree events appear in the issued cases:

```
kmalloc: call_site=build_tree+0x228/0x620 ptr=ffffa10b013f0b00 bytes_req=64 bytes_alloc=64 gfp_flags=GFP_ATOMIC|__GFP_ZERO node=-1 accounted=false
kmalloc: call_site=build_tree+0x228/0x620 ptr=ffffa10b013f0b40 bytes_req=48 bytes_alloc=64 gfp_flags=GFP_ATOMIC|__GFP_ZERO node=-1 accounted=false
kmalloc: call_site=build_tree+0x228/0x620 ptr=ffffa10b013f0b80 bytes_req=64 bytes_alloc=64 gfp_flags=GFP_ATOMIC|__GFP_ZERO node=-1 accounted=false
firewire_core node_tree_test_invalid_parent_port_count.dummy-device: parent port inconsistency for node 3: parent_count=2
kfree: call_site=for_each_fw_node+0x17c/0x230 ptr=ffffa10b013f0b80
kfree: call_site=for_each_fw_node+0x17c/0x230 ptr=ffffa10b013f0b00
kfree: call_site=for_each_fw_node+0x17c/0x230 ptr=ffffa10b013f0b40
```

[1][PATCH v2] firewire: core: fix possible memory leak in build_tree()
https://lore.kernel.org/lkml/20260801110915.82561-1-nihaal@cse.iitm.ac.in/
[2][PATCH 0/3] firewire: core: add KUnit tests for tree building
https://lore.kernel.org/lkml/20260810064119.410324-1-o-takashi@sakamocchi.jp/


Takashi Sakamoto (3):
  firewire: core: consolidate port counting in build_tree()
  firewire: core: validate parent port count before allocating nodes in
    build_tree()
  firewire: core: fix memory leak in error path of build_tree()

 drivers/firewire/core-topology.c | 58 ++++++++++++++++++++------------
 1 file changed, 36 insertions(+), 22 deletions(-)


base-commit: f744022705b7eb479a1931ddd95aae4e9a4be221
-- 
2.53.0

On Tue, Aug 11, 2026 at 09:09:25PM +0900, Takashi Sakamoto wrote:
> Hi,
> 
> This patchset fixes a potential memory leak in the error path of
> build_tree(), reported by Abdun Nihaal[1].
> 
> The first two patches refactor build tree() to optimize port counting and
> the place of parent port validation. The last patch fixes the error path
> to release allocated node instances properly.
> 
> The changes were verified using the kmem:kmalloc and kmem:kfree
> tracepoints together with the KUnit tests added in my former patchset[2].
> The kmem:kfree events appear in the issued cases:
> 
> ```
> kmalloc: call_site=build_tree+0x228/0x620 ptr=ffffa10b013f0b00 bytes_req=64 bytes_alloc=64 gfp_flags=GFP_ATOMIC|__GFP_ZERO node=-1 accounted=false
> kmalloc: call_site=build_tree+0x228/0x620 ptr=ffffa10b013f0b40 bytes_req=48 bytes_alloc=64 gfp_flags=GFP_ATOMIC|__GFP_ZERO node=-1 accounted=false
> kmalloc: call_site=build_tree+0x228/0x620 ptr=ffffa10b013f0b80 bytes_req=64 bytes_alloc=64 gfp_flags=GFP_ATOMIC|__GFP_ZERO node=-1 accounted=false
> firewire_core node_tree_test_invalid_parent_port_count.dummy-device: parent port inconsistency for node 3: parent_count=2
> kfree: call_site=for_each_fw_node+0x17c/0x230 ptr=ffffa10b013f0b80
> kfree: call_site=for_each_fw_node+0x17c/0x230 ptr=ffffa10b013f0b00
> kfree: call_site=for_each_fw_node+0x17c/0x230 ptr=ffffa10b013f0b40
> ```
> 
> [1][PATCH v2] firewire: core: fix possible memory leak in build_tree()
> https://lore.kernel.org/lkml/20260801110915.82561-1-nihaal@cse.iitm.ac.in/
> [2][PATCH 0/3] firewire: core: add KUnit tests for tree building
> https://lore.kernel.org/lkml/20260810064119.410324-1-o-takashi@sakamocchi.jp/
> 
> 
> Takashi Sakamoto (3):
>   firewire: core: consolidate port counting in build_tree()
>   firewire: core: validate parent port count before allocating nodes in
>     build_tree()
>   firewire: core: fix memory leak in error path of build_tree()
> 
>  drivers/firewire/core-topology.c | 58 ++++++++++++++++++++------------
>  1 file changed, 36 insertions(+), 22 deletions(-)

Applied to for-next branch, with some removals of code comments in
node-tree-test.c addressing to the memory leak.


Regards

Takashi Sakamoto