[PATCH] rtc: meson: fix refcount leak in meson_rtc_get_bus

[PATCH] rtc: meson: fix refcount leak in meson_rtc_get_bus

[WenTao Liang]

In meson_rtc_get_bus(), reset_control_reset() is called to trigger
a hardware reset when the serial bus is not ready. The function may
retry up to three times, but neither the successful nor the failure
path calls reset_control_rearm() to balance the reference count,
leaking the triggered_count on shared reset controls.

Fix this by adding reset_control_rearm() after reset_control_reset()
on both the error return path and the success path within the retry
loop, ensuring the reset control can be re-triggered on subsequent
bus acquisition attempts.

Cc: stable@vger.kernel.org
Fixes: d8fe6009aa3e ("rtc: support for the Amlogic Meson RTC")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
 drivers/rtc/rtc-meson.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/rtc/rtc-meson.c b/drivers/rtc/rtc-meson.c
index 21eceb9e2e13..729384dceb12 100644
--- a/drivers/rtc/rtc-meson.c
+++ b/drivers/rtc/rtc-meson.c
@@ -146,8 +146,12 @@ static int meson_rtc_get_bus(struct meson_rtc *rtc)
 		dev_warn(rtc->dev, "failed to get bus, resetting RTC\n");
 
 		ret = reset_control_reset(rtc->reset);
-		if (ret)
+		if (ret) {
+			reset_control_rearm(rtc->reset);
 			return ret;
+		}
+
+		reset_control_rearm(rtc->reset);
 	}
 
 	dev_err(rtc->dev, "bus is not ready\n");
-- 
2.50.1 (Apple Git-155)


_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic

Re: [PATCH] rtc: meson: fix refcount leak in meson_rtc_get_bus

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The patch attempts to fix a non-existent refcount leak by adding reset_control_rearm() to an exclusive reset control (where it is a no-op). Furthermore, if the reset control were actually shared, adding reset_control_rearm() to the error path would cause a double-decrement underflow bug.
--

commit c52dd99142fd976704b680f05d5ba9c353703d91
Author: WenTao Liang <vulab@iscas.ac.cn>

rtc: meson: fix refcount leak in meson_rtc_get_bus

This commit attempts to fix a refcount leak by adding reset_control_rearm()
to both the error and success paths of reset_control_reset() in
meson_rtc_get_bus().

> diff --git a/drivers/rtc/rtc-meson.c b/drivers/rtc/rtc-meson.c
> index 21eceb9e2e134..3c45cd761a15a 100644
> --- a/drivers/rtc/rtc-meson.c
> +++ b/drivers/rtc/rtc-meson.c
[ ... ]
> @@ -146,8 +146,12 @@ static int meson_rtc_get_bus(struct meson_rtc *rtc)
>  		dev_warn(rtc->dev, "failed to get bus, resetting RTC\n");
>  
>  		ret = reset_control_reset(rtc->reset);
> -		if (ret)
> +		if (ret) {
> +			reset_control_rearm(rtc->reset);

[Severity: Medium]
Is this reset control actually shared? The rtc->reset appears to be acquired
as an exclusive reset control, where reset_control_rearm() is documented to
be a no-op and triggered_count is not used.

Also, if this were a shared reset control, would calling
reset_control_rearm() on the error path cause a double-decrement underflow?

The reset core framework automatically rolls back the triggered_count
increment if the underlying hardware reset fails. Manually calling
reset_control_rearm() after a failure might drop the counter below zero
and trigger a warning.

>  			return ret;
> +		}
> +
> +		reset_control_rearm(rtc->reset);
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260611035605.59906-1-vulab@iscas.ac.cn?part=1

_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic

Re: [PATCH] rtc: meson: fix refcount leak in meson_rtc_get_bus

[Philipp Zabel]

On Thu, Jun 11, 2026 at 11:56:05AM +0800, WenTao Liang wrote:
> In meson_rtc_get_bus(), reset_control_reset() is called to trigger
> a hardware reset when the serial bus is not ready. The function may
> retry up to three times, but neither the successful nor the failure
> path calls reset_control_rearm() to balance the reference count,
> leaking the triggered_count on shared reset controls.

Wrong, this driver uses exclusive reset control, which does not do any
refcounting. Arguably, it should request the reset control via
devm_regulator_get_exclusive() instead of devm_regulator_get() to
make this clear.

> Fix this by adding reset_control_rearm() after reset_control_reset()
> on both the error return path and the success path within the retry
> loop, ensuring the reset control can be re-triggered on subsequent
> bus acquisition attempts.

This doesn't fix anything, reset_control_rearm() does nothing and
should not be used with exclusive reset controls.

regards
Philipp

_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic

[PATCH] rtc: meson: fix refcount leak in meson_rtc_get_bus

[WenTao Liang]

In meson_rtc_get_bus(), reset_control_reset() is called to trigger
a hardware reset when the serial bus is not ready. The function may
retry up to three times, but neither the successful nor the failure
path calls reset_control_rearm() to balance the reference count,
leaking the triggered_count on shared reset controls.

Fix this by adding reset_control_rearm() after reset_control_reset()
on both the error return path and the success path within the retry
loop, ensuring the reset control can be re-triggered on subsequent
bus acquisition attempts.

Cc: stable@vger.kernel.org
Fixes: d8fe6009aa3e ("rtc: support for the Amlogic Meson RTC")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
 drivers/rtc/rtc-meson.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/rtc/rtc-meson.c b/drivers/rtc/rtc-meson.c
index 21eceb9e2e13..729384dceb12 100644
--- a/drivers/rtc/rtc-meson.c
+++ b/drivers/rtc/rtc-meson.c
@@ -146,8 +146,12 @@ static int meson_rtc_get_bus(struct meson_rtc *rtc)
 		dev_warn(rtc->dev, "failed to get bus, resetting RTC\n");
 
 		ret = reset_control_reset(rtc->reset);
-		if (ret)
+		if (ret) {
+			reset_control_rearm(rtc->reset);
 			return ret;
+		}
+
+		reset_control_rearm(rtc->reset);
 	}
 
 	dev_err(rtc->dev, "bus is not ready\n");
-- 
2.50.1 (Apple Git-155)


_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic

Re: [PATCH] rtc: meson: fix refcount leak in meson_rtc_get_bus

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Bogus fix attempting to fix a non-existent refcount leak, which violates the reset API contract and introduces a potential counter underflow.
--

commit dec7a1c708a5b28d1344bf6fb038df54d6001df3
Author: WenTao Liang <vulab@iscas.ac.cn>
rtc: meson: fix refcount leak in meson_rtc_get_bus

This commit adds calls to reset_control_rearm() in both the error and success
paths of meson_rtc_get_bus() after triggering a reset. The intention is to
prevent a triggered_count leak on shared reset controls.

> diff --git a/drivers/rtc/rtc-meson.c b/drivers/rtc/rtc-meson.c
> index 21eceb9e2e134..3c45cd761a15a 100644
> --- a/drivers/rtc/rtc-meson.c
> +++ b/drivers/rtc/rtc-meson.c
> @@ -146,8 +146,12 @@ static int meson_rtc_get_bus(struct meson_rtc *rtc)
>  		dev_warn(rtc->dev, "failed to get bus, resetting RTC\n");
>  
>  		ret = reset_control_reset(rtc->reset);
> -		if (ret)
> +		if (ret) {
> +			reset_control_rearm(rtc->reset);

[Severity: Medium]
Is this fix applicable to this driver's reset control?

The reset control rtc->reset is acquired as an exclusive control using
devm_reset_control_get(). Exclusive controls do not track triggered_count,
so calling reset_control_rearm() is a no-op in this context, meaning there
was no leak to fix.

Additionally, if this were a shared reset control, would calling
reset_control_rearm() on the error path cause a counter underflow?

The reset core already handles the rollback internally by decrementing
triggered_count if the underlying reset fails. Adding a manual
reset_control_rearm() here on failure would decrement it a second time,
which could trigger a WARN_ON() for dropping below zero.

> +			return ret;
> +		}
> +
> +		reset_control_rearm(rtc->reset);
>  	}
>  
>  	dev_err(rtc->dev, "bus is not ready\n");

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260611034040.59682-1-vulab@iscas.ac.cn?part=1

_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic