Re: [PATCH v4 4/8] reset: Add reset_control_get_from_provider_exclusive()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] of: memory leak of device node reference on error path
--

commit 6e1c5e27c808997c3ce5fe5fc257fedbfabb6954
Author: Geert Uytterhoeven <geert+renesas@glider.be>

reset: Add reset_control_get_from_provider_exclusive()

This patch introduces reset_control_get_from_provider_exclusive() to allow
looking up and obtaining an exclusive reference to a reset controller from
a provider. It modifies the existing __reset_control_get_from_provider()
helper to support this lookup.

> diff --git a/drivers/reset/core.c b/drivers/reset/core.c
> index 0e11f4c81c10d..421bcc4c89cc2 100644
> --- a/drivers/reset/core.c
> +++ b/drivers/reset/core.c
> @@ -1153,18 +1154,30 @@ __reset_control_get_from_provider(const struct fwnode_reference_args *args,
>  	if (WARN_ON(args->nargs != rcdev->fwnode_reset_n_cells))
>  		return ERR_PTR(-EINVAL);
>  
> -	if (rcdev->of_xlate && is_of_node(consumer)) {
> -		struct device_node *np = to_of_node(consumer);
> +	if (rcdev->of_xlate && is_of_node(fwnode)) {
> +		struct device_node *np = to_of_node(fwnode);
>  		struct of_phandle_args of_args;
>  		int ret;
>  
> -		ret = of_parse_phandle_with_args(np,
> +		if (consumer) {
> +			ret = of_parse_phandle_with_args(np,
>  					 gpio_fallback ? "reset-gpios" : "resets",
>  					 gpio_fallback ? "#gpio-cells" : "#reset-cells",
>  					 gpio_fallback ? 0 : index,
>  					 &of_args);
> -		if (ret)
> -			return ERR_PTR(ret);
> +			if (ret)
> +				return ERR_PTR(ret);
> +		} else {
> +			of_args.np = of_node_get(np);
> +			of_args.args_count = args->nargs;
> +
> +			for (unsigned int i = 0; i < args->nargs; i++) {
> +				if (args->args[i] > U32_MAX)
> +					return ERR_PTR(-EINVAL);

[Severity: Medium]
Will this leak the device node reference acquired above?

When consumer is NULL in __reset_control_get_from_provider(), the code
acquires a device node reference via of_args.np = of_node_get(np).

If an argument exceeds U32_MAX, the function immediately returns
ERR_PTR(-EINVAL). This early return skips the of_node_put(of_args.np) call
at the end of the block, permanently leaking the OF node reference count.

> +
> +				of_args.args[i] = args->args[i];
> +			}
> +		}
>  
>  		rstc_id = rcdev->of_xlate(rcdev, &of_args);
>  		of_node_put(of_args.np);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1792163045.git.geert+renesas@glider.be?part=4