[PATCH] misc: rp1: do not put borrowed OF node

[PATCH] misc: rp1: do not put borrowed OF node

[Pengpeng Hou]

dev_of_node() returns the device's OF node without taking a new
reference. rp1_probe() stores that borrowed pointer in rp1_node, but
drops it with of_node_put() on both success and failure paths.

Dropping a reference that was never acquired can underflow the node's
refcount and leave later users with a stale OF node. Remove the
of_node_put() calls and keep rp1_node as a borrowed pointer.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/misc/rp1/rp1_pci.c | 20 ++++++++------------
 1 file changed, 8 insertions(+), 12 deletions(-)

diff --git a/drivers/misc/rp1/rp1_pci.c b/drivers/misc/rp1/rp1_pci.c
index 81685e3f3296..ddee00045fd3 100644
--- a/drivers/misc/rp1/rp1_pci.c
+++ b/drivers/misc/rp1/rp1_pci.c
@@ -191,13 +191,13 @@ static int rp1_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	if (!rp1_node) {
 		dev_err(dev, "Missing of_node for device\n");
 		err = -EINVAL;
-		goto err_put_node;
+		goto err_out;
 	}
 
 	rp1 = devm_kzalloc(&pdev->dev, sizeof(*rp1), GFP_KERNEL);
 	if (!rp1) {
 		err = -ENOMEM;
-		goto err_put_node;
+		goto err_out;
 	}
 
 	rp1->pdev = pdev;
@@ -206,21 +206,21 @@ static int rp1_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 		dev_err(&pdev->dev,
 			"Not initialized - is the firmware running?\n");
 		err = -EINVAL;
-		goto err_put_node;
+		goto err_out;
 	}
 
 	err = pcim_enable_device(pdev);
 	if (err < 0) {
 		err = dev_err_probe(&pdev->dev, err,
 				    "Enabling PCI device has failed");
-		goto err_put_node;
+		goto err_out;
 	}
 
 	rp1->bar1 = pcim_iomap(pdev, 1, 0);
 	if (!rp1->bar1) {
 		dev_err(&pdev->dev, "Cannot map PCI BAR\n");
 		err = -EIO;
-		goto err_put_node;
+		goto err_out;
 	}
 
 	pci_set_master(pdev);
@@ -230,11 +230,11 @@ static int rp1_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	if (err < 0) {
 		err = dev_err_probe(&pdev->dev, err,
 				    "Failed to allocate MSI-X vectors\n");
-		goto err_put_node;
+		goto err_out;
 	} else if (err != RP1_INT_END) {
 		dev_err(&pdev->dev, "Cannot allocate enough interrupts\n");
 		err = -EINVAL;
-		goto err_put_node;
+		goto err_out;
 	}
 
 	pci_set_drvdata(pdev, rp1);
@@ -267,15 +267,11 @@ static int rp1_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 		goto err_unregister_interrupts;
 	}
 
-	of_node_put(rp1_node);
-
 	return 0;
 
 err_unregister_interrupts:
 	rp1_unregister_interrupts(pdev);
-err_put_node:
-	of_node_put(rp1_node);
-
+err_out:
 	return err;
 }
 
-- 
2.43.0

Re: [PATCH] misc: rp1: do not put borrowed OF node

[Andrea della Porta]

Hi,

On 23:08 Tue 16 Jun     , Pengpeng Hou wrote:
> dev_of_node() returns the device's OF node without taking a new
> reference. rp1_probe() stores that borrowed pointer in rp1_node, but
> drops it with of_node_put() on both success and failure paths.
> 
> Dropping a reference that was never acquired can underflow the node's
> refcount and leave later users with a stale OF node. Remove the
> of_node_put() calls and keep rp1_node as a borrowed pointer.
> 
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
>  drivers/misc/rp1/rp1_pci.c | 20 ++++++++------------
>  1 file changed, 8 insertions(+), 12 deletions(-)
> 
> diff --git a/drivers/misc/rp1/rp1_pci.c b/drivers/misc/rp1/rp1_pci.c
> index 81685e3f3296..ddee00045fd3 100644
> --- a/drivers/misc/rp1/rp1_pci.c
> +++ b/drivers/misc/rp1/rp1_pci.c
> @@ -191,13 +191,13 @@ static int rp1_probe(struct pci_dev *pdev, const struct pci_device_id *id)
>  	if (!rp1_node) {
>  		dev_err(dev, "Missing of_node for device\n");
>  		err = -EINVAL;
> -		goto err_put_node;
> +		goto err_out;
>  	}
>  
>  	rp1 = devm_kzalloc(&pdev->dev, sizeof(*rp1), GFP_KERNEL);
>  	if (!rp1) {
>  		err = -ENOMEM;
> -		goto err_put_node;
> +		goto err_out;
>  	}
>  
>  	rp1->pdev = pdev;
> @@ -206,21 +206,21 @@ static int rp1_probe(struct pci_dev *pdev, const struct pci_device_id *id)
>  		dev_err(&pdev->dev,
>  			"Not initialized - is the firmware running?\n");
>  		err = -EINVAL;
> -		goto err_put_node;
> +		goto err_out;
>  	}
>  
>  	err = pcim_enable_device(pdev);
>  	if (err < 0) {
>  		err = dev_err_probe(&pdev->dev, err,
>  				    "Enabling PCI device has failed");
> -		goto err_put_node;
> +		goto err_out;
>  	}
>  
>  	rp1->bar1 = pcim_iomap(pdev, 1, 0);
>  	if (!rp1->bar1) {
>  		dev_err(&pdev->dev, "Cannot map PCI BAR\n");
>  		err = -EIO;
> -		goto err_put_node;
> +		goto err_out;
>  	}
>  
>  	pci_set_master(pdev);
> @@ -230,11 +230,11 @@ static int rp1_probe(struct pci_dev *pdev, const struct pci_device_id *id)
>  	if (err < 0) {
>  		err = dev_err_probe(&pdev->dev, err,
>  				    "Failed to allocate MSI-X vectors\n");
> -		goto err_put_node;
> +		goto err_out;
>  	} else if (err != RP1_INT_END) {
>  		dev_err(&pdev->dev, "Cannot allocate enough interrupts\n");
>  		err = -EINVAL;
> -		goto err_put_node;
> +		goto err_out;
>  	}
>  
>  	pci_set_drvdata(pdev, rp1);
> @@ -267,15 +267,11 @@ static int rp1_probe(struct pci_dev *pdev, const struct pci_device_id *id)
>  		goto err_unregister_interrupts;
>  	}
>  
> -	of_node_put(rp1_node);
> -
>  	return 0;
>  
>  err_unregister_interrupts:
>  	rp1_unregister_interrupts(pdev);
> -err_put_node:
> -	of_node_put(rp1_node);
> -
> +err_out:
>  	return err;
>  }
>  
> -- 
> 2.43.0
>

Thanks for your patch!

Reviewed-by: Andrea della Porta <andrea.porta@suse.com>