Linux ACPI
 help / color / mirror / Atom feed
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
To: Xu Yang <xu.yang_2@oss.nxp.com>
Cc: Daniel Scally <djrscally@gmail.com>,
	Heikki Krogerus <heikki.krogerus@linux.intel.com>,
	Sakari Ailus <sakari.ailus@linux.intel.com>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	"Rafael J. Wysocki" <rafael@kernel.org>,
	Danilo Krummrich <dakr@kernel.org>,
	Mauro Carvalho Chehab <mchehab+huawei@kernel.org>,
	Laurent Pinchart <laurent.pinchart@ideasonboard.com>,
	linux-acpi@vger.kernel.org, driver-core@lists.linux.dev,
	linux-kernel@vger.kernel.org,
	Bartosz Golaszewski <brgl@kernel.org>,
	Xu Yang <xu.yang_2@nxp.com>,
	stable@vger.kernel.org
Subject: Re: [PATCH v3 0/2] device property: fix child iteration issues with secondary fwnodes
Date: Thu, 11 Jun 2026 23:36:56 +0300	[thread overview]
Message-ID: <aiscaI0B4ogb15T7@ashevche-desk.local> (raw)
In-Reply-To: <aipsAxc4j68D2YCz@ashevche-desk.local>

On Thu, Jun 11, 2026 at 11:04:25AM +0300, Andy Shevchenko wrote:
> On Mon, Jun 08, 2026 at 10:41:45AM +0800, Xu Yang wrote:
> > On Fri, Jun 05, 2026 at 06:52:49PM +0300, Andy Shevchenko wrote:
> > > On Fri, Jun 05, 2026 at 06:07:41PM +0300, Andy Shevchenko wrote:
> > > > On Fri, Jun 05, 2026 at 06:31:16PM +0800, Xu Yang wrote:
> > > > > This series fixes two issues in the fwnode child iteration logic when
> > > > > a secondary fwnode is present.
> > > > > 
> > > > > The first issue is  a refcount imbalance in software_node_get_next_child().
> > > > > When a software node is used as a secondary fwnode, the iteration code may
> > > > > incorrectly decrement the refcount of child nodes that do not belong to the
> > > > > software node hierarchy. This results in refcount underflow and possible
> > > > > use-after-free.
> > > > > 
> > > > > The second issue is an infinite loop in fwnode_for_each_child_node(), caused
> > > > > by improper handling of iteration state across primary and secondary fwnodes.
> > > > > When iterating over children from both primary and secondary fwnodes, the code
> > > > > may incorrectly resume iteration from the primary fwnode even when the current
> > > > > child belongs to the secondary, leading to repeated traversal and a loop.
> > > > > 
> > > > > Both issues are triggered when mixing different fwnode types through the
> > > > > secondary mechanism, and stem from incorrect assumptions about ownership
> > > > > and traversal context of child nodes.
> > > > 
> > > > > ---
> > > > > Changes in v3:
> > > > > - remove software node patch 
> > > > 
> > > > Hmm... Maybe I was unclear. My question was to investigate the way to actually
> > > > move software node to use the swnode APIs (and not fwnode ones) and be on par
> > > > with what OF code does. This series does the opposite and adds a hack to the
> > > > next_child implementation.
> > > > 
> > > > > - add a kunit test case suggested by Andy Shevchenko
> > > > 
> > > > But thanks for the test case!
> > > 
> > > I'm preparing another patch (just a clean up) and I see that your test cases
> > > indeed fail without any other patch being applied. Also noticed that the test
> > > cases are not fully compliant with the requirement of the "primary"/"secondary"
> > > fwnode flavours. But this doesn't affect the execution.
> > > 
> > > I will play more with this to understand the problem better.
> > 
> > OK. Suggestions on the fwnode flavours would be appreciated :)
> 
> I think your approach is what we should go with. I will send a v4 with my tags
> and some amendments.

I sent a v4 here:
20260611203537.1786399-1-andriy.shevchenko@linux.intel.com
Please, test and confirm it also works for you as expected.

-- 
With Best Regards,
Andy Shevchenko



      reply	other threads:[~2026-06-11 20:37 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-06-05 10:31 [PATCH v3 0/2] device property: fix child iteration issues with secondary fwnodes Xu Yang
2026-06-05 10:31 ` [PATCH v3 1/2] device property: fix infinite loop in fwnode_for_each_child_node() Xu Yang
2026-06-05 10:31 ` [PATCH v3 2/2] drivers: base: test: add test cases for fwnode_for_each_child_node() Xu Yang
2026-06-05 15:07 ` [PATCH v3 0/2] device property: fix child iteration issues with secondary fwnodes Andy Shevchenko
2026-06-05 15:52   ` Andy Shevchenko
2026-06-08  2:41     ` Xu Yang
2026-06-11  8:04       ` Andy Shevchenko
2026-06-11 20:36         ` Andy Shevchenko [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=aiscaI0B4ogb15T7@ashevche-desk.local \
    --to=andriy.shevchenko@linux.intel.com \
    --cc=brgl@kernel.org \
    --cc=dakr@kernel.org \
    --cc=djrscally@gmail.com \
    --cc=driver-core@lists.linux.dev \
    --cc=gregkh@linuxfoundation.org \
    --cc=heikki.krogerus@linux.intel.com \
    --cc=laurent.pinchart@ideasonboard.com \
    --cc=linux-acpi@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mchehab+huawei@kernel.org \
    --cc=rafael@kernel.org \
    --cc=sakari.ailus@linux.intel.com \
    --cc=stable@vger.kernel.org \
    --cc=xu.yang_2@nxp.com \
    --cc=xu.yang_2@oss.nxp.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox