[PATCH v2 1/1] lib/vsprintf: Fix %pfwf when current node refcount == 0

[PATCH v2 1/1] lib/vsprintf: Fix %pfwf when current node refcount == 0

[Herve Codina]

A refcount issue can appeared in __fwnode_link_del() due to the
pr_debug() call:
  WARNING: CPU: 0 PID: 901 at lib/refcount.c:25 refcount_warn_saturate+0xe5/0x110
  Call Trace:
  <TASK>
  ...
  of_node_get+0x1e/0x30
  of_fwnode_get+0x28/0x40
  fwnode_full_name_string+0x34/0x90
  fwnode_string+0xdb/0x140
  ...
  vsnprintf+0x17b/0x630
  ...
  __fwnode_link_del+0x25/0xa0
  fwnode_links_purge+0x39/0xb0
  of_node_release+0xd9/0x180
  ...

Indeed, an fwnode (of_node) is being destroyed and so, of_node_release()
is called because the of_node refcount reached 0.
From of_node_release() several function calls are done and lead to
a pr_debug() calls with %pfwf to print the fwnode full name.
The issue is not present if we change %pfwf to %pfwP.

To print the full name, %pfwf iterates over the current node and its
parents and obtain/drop a reference to all nodes involved.

In order to allow to print the full name (%pfwf) of a node while it is
being destroyed, do not obtain/drop a reference to this current node.

Fixes: a92eb7621b9f ("lib/vsprintf: Make use of fwnode API to obtain node names and separators")
Cc: stable@vger.kernel.org
Signed-off-by: Herve Codina <herve.codina@bootlin.com>
---
Changes v1 -> v2
  - Avoid handling current node out of the loop. Instead obtain/drop references
    in the loop based on the depth value.
  - Remove some of the backtrace lines in the commit log.

 lib/vsprintf.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index afb88b24fa74..633f5481ac17 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -2110,15 +2110,20 @@ char *fwnode_full_name_string(struct fwnode_handle *fwnode, char *buf,
 
 	/* Loop starting from the root node to the current node. */
 	for (depth = fwnode_count_parents(fwnode); depth >= 0; depth--) {
-		struct fwnode_handle *__fwnode =
-			fwnode_get_nth_parent(fwnode, depth);
+		/*
+		 * Only get a reference for other nodes (ie parents node).
+		 * fwnode refcount may be 0 here.
+		 */
+		struct fwnode_handle *__fwnode = depth ?
+			fwnode_get_nth_parent(fwnode, depth) : fwnode;
 
 		buf = string(buf, end, fwnode_get_name_prefix(__fwnode),
 			     default_str_spec);
 		buf = string(buf, end, fwnode_get_name(__fwnode),
 			     default_str_spec);
 
-		fwnode_handle_put(__fwnode);
+		if (depth)
+			fwnode_handle_put(__fwnode);
 	}
 
 	return buf;
-- 
2.41.0

Re: [PATCH v2 1/1] lib/vsprintf: Fix %pfwf when current node refcount == 0

[Sakari Ailus]

Hi Herve,

On Tue, Nov 14, 2023 at 03:35:58PM +0100, Herve Codina wrote:
> A refcount issue can appeared in __fwnode_link_del() due to the
> pr_debug() call:
>   WARNING: CPU: 0 PID: 901 at lib/refcount.c:25 refcount_warn_saturate+0xe5/0x110
>   Call Trace:
>   <TASK>
>   ...
>   of_node_get+0x1e/0x30
>   of_fwnode_get+0x28/0x40
>   fwnode_full_name_string+0x34/0x90
>   fwnode_string+0xdb/0x140
>   ...
>   vsnprintf+0x17b/0x630
>   ...
>   __fwnode_link_del+0x25/0xa0
>   fwnode_links_purge+0x39/0xb0
>   of_node_release+0xd9/0x180
>   ...
> 
> Indeed, an fwnode (of_node) is being destroyed and so, of_node_release()
> is called because the of_node refcount reached 0.
> From of_node_release() several function calls are done and lead to
> a pr_debug() calls with %pfwf to print the fwnode full name.
> The issue is not present if we change %pfwf to %pfwP.
> 
> To print the full name, %pfwf iterates over the current node and its
> parents and obtain/drop a reference to all nodes involved.
> 
> In order to allow to print the full name (%pfwf) of a node while it is
> being destroyed, do not obtain/drop a reference to this current node.
> 
> Fixes: a92eb7621b9f ("lib/vsprintf: Make use of fwnode API to obtain node names and separators")
> Cc: stable@vger.kernel.org
> Signed-off-by: Herve Codina <herve.codina@bootlin.com>
> ---
> Changes v1 -> v2
>   - Avoid handling current node out of the loop. Instead obtain/drop references
>     in the loop based on the depth value.
>   - Remove some of the backtrace lines in the commit log.
> 
>  lib/vsprintf.c | 11 ++++++++---
>  1 file changed, 8 insertions(+), 3 deletions(-)
> 
> diff --git a/lib/vsprintf.c b/lib/vsprintf.c
> index afb88b24fa74..633f5481ac17 100644
> --- a/lib/vsprintf.c
> +++ b/lib/vsprintf.c
> @@ -2110,15 +2110,20 @@ char *fwnode_full_name_string(struct fwnode_handle *fwnode, char *buf,
>  
>  	/* Loop starting from the root node to the current node. */
>  	for (depth = fwnode_count_parents(fwnode); depth >= 0; depth--) {
> -		struct fwnode_handle *__fwnode =
> -			fwnode_get_nth_parent(fwnode, depth);
> +		/*
> +		 * Only get a reference for other nodes (ie parents node).

"i.e."

With that,

Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>

> +		 * fwnode refcount may be 0 here.
> +		 */
> +		struct fwnode_handle *__fwnode = depth ?
> +			fwnode_get_nth_parent(fwnode, depth) : fwnode;
>  
>  		buf = string(buf, end, fwnode_get_name_prefix(__fwnode),
>  			     default_str_spec);
>  		buf = string(buf, end, fwnode_get_name(__fwnode),
>  			     default_str_spec);
>  
> -		fwnode_handle_put(__fwnode);
> +		if (depth)
> +			fwnode_handle_put(__fwnode);
>  	}
>  
>  	return buf;

-- 
Regards,

Sakari Ailus

Re: [PATCH v2 1/1] lib/vsprintf: Fix %pfwf when current node refcount == 0

[Herve Codina]

Hi Sakari,

On Tue, 14 Nov 2023 14:47:25 +0000
Sakari Ailus <sakari.ailus@linux.intel.com> wrote:

[...]

> > +		 * Only get a reference for other nodes (ie parents node).  
> 
> "i.e."

Will be changed in the next iteration.

> 
> With that,
> 
> Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>

Best regards,
Hervé

Re: [PATCH v2 1/1] lib/vsprintf: Fix %pfwf when current node refcount == 0

[Andy Shevchenko]

On Tue, Nov 14, 2023 at 03:35:58PM +0100, Herve Codina wrote:
> A refcount issue can appeared in __fwnode_link_del() due to the
> pr_debug() call:
>   WARNING: CPU: 0 PID: 901 at lib/refcount.c:25 refcount_warn_saturate+0xe5/0x110
>   Call Trace:
>   <TASK>
>   ...
>   of_node_get+0x1e/0x30
>   of_fwnode_get+0x28/0x40
>   fwnode_full_name_string+0x34/0x90
>   fwnode_string+0xdb/0x140
>   ...
>   vsnprintf+0x17b/0x630
>   ...
>   __fwnode_link_del+0x25/0xa0
>   fwnode_links_purge+0x39/0xb0
>   of_node_release+0xd9/0x180
>   ...
> 
> Indeed, an fwnode (of_node) is being destroyed and so, of_node_release()
> is called because the of_node refcount reached 0.
> From of_node_release() several function calls are done and lead to
> a pr_debug() calls with %pfwf to print the fwnode full name.
> The issue is not present if we change %pfwf to %pfwP.
> 
> To print the full name, %pfwf iterates over the current node and its
> parents and obtain/drop a reference to all nodes involved.
> 
> In order to allow to print the full name (%pfwf) of a node while it is
> being destroyed, do not obtain/drop a reference to this current node.

One nit-pick below, otherwise
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

...

>  	/* Loop starting from the root node to the current node. */
>  	for (depth = fwnode_count_parents(fwnode); depth >= 0; depth--) {
> -		struct fwnode_handle *__fwnode =
> -			fwnode_get_nth_parent(fwnode, depth);
> +		/*
> +		 * Only get a reference for other nodes (ie parents node).

"parent's node" (doesn't look right)? Or "parent nodes"?

> +		 * fwnode refcount may be 0 here.
> +		 */
> +		struct fwnode_handle *__fwnode = depth ?
> +			fwnode_get_nth_parent(fwnode, depth) : fwnode;
>  
>  		buf = string(buf, end, fwnode_get_name_prefix(__fwnode),
>  			     default_str_spec);
>  		buf = string(buf, end, fwnode_get_name(__fwnode),
>  			     default_str_spec);
>  
> -		fwnode_handle_put(__fwnode);
> +		if (depth)
> +			fwnode_handle_put(__fwnode);
>  	}

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH v2 1/1] lib/vsprintf: Fix %pfwf when current node refcount == 0

[Herve Codina]

Hi Andy,

On Tue, 14 Nov 2023 16:59:35 +0200
Andy Shevchenko <andriy.shevchenko@linux.intel.com> wrote:

[...]

> 
> One nit-pick below, otherwise
> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> 
> ...
> 
> >  	/* Loop starting from the root node to the current node. */
> >  	for (depth = fwnode_count_parents(fwnode); depth >= 0; depth--) {
> > -		struct fwnode_handle *__fwnode =
> > -			fwnode_get_nth_parent(fwnode, depth);
> > +		/*
> > +		 * Only get a reference for other nodes (ie parents node).  
> 
> "parent's node" (doesn't look right)? Or "parent nodes"?
> 

Will be changed to "parent nodes" in the next iteration.

Best regards,
Hervé