[PATCH 0/5] add missing of_node_put

[PATCH 0/5] add missing of_node_put

[Julia Lawall]

for_each_child_of_node performs an of_node_get on each iteration, so
a break out of the loop requires an of_node_put.

The complete semantic patch that fixes this problem is
(http://coccinelle.lip6.fr):

// <smpl>
@@
expression root,e;
local idexpression child;
iterator name for_each_child_of_node;
@@

 for_each_child_of_node(root, child) {
   ... when != of_node_put(child)
       when != e = child
+  of_node_put(child);
?  break;
   ...
}
... when != child

@@
expression root,e;
local idexpression child;
@@

 for_each_child_of_node(root, child) {
   ... when != of_node_put(child)
       when != e = child
(
   return child;
|
+  of_node_put(child);
?  return ...;
)
   ...
 }
// </smpl>

---

 arch/arm/kernel/devtree.c             |    1 +
 arch/arm/mach-shmobile/pm-rmobile.c   |    4 +++-
 drivers/power/charger-manager.c       |    4 +++-
 drivers/regulator/of_regulator.c      |    1 +
 drivers/video/backlight/88pm860x_bl.c |    1 +
 5 files changed, 9 insertions(+), 2 deletions(-)

[PATCH 3/5] ARM: shmobile: R-Mobile: add missing of_node_put

[Julia Lawall]

for_each_child_of_node performs an of_node_get on each iteration, so
a break out of the loop requires an of_node_put.

The semantic patch that fixes this problem is as follows
(http://coccinelle.lip6.fr):

// <smpl>
@@
expression root,e;
local idexpression child;
@@

 for_each_child_of_node(root, child) {
   ... when != of_node_put(child)
       when != e = child
(
   return child;
|
+  of_node_put(child);
?  return ...;
)
   ...
 }
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>

---
 arch/arm/mach-shmobile/pm-rmobile.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/arm/mach-shmobile/pm-rmobile.c b/arch/arm/mach-shmobile/pm-rmobile.c
index 89068c8..46d0a1d 100644
--- a/arch/arm/mach-shmobile/pm-rmobile.c
+++ b/arch/arm/mach-shmobile/pm-rmobile.c
@@ -313,8 +313,10 @@ static int __init rmobile_add_pm_domains(void __iomem *base,
 		}
 
 		pd = kzalloc(sizeof(*pd), GFP_KERNEL);
-		if (!pd)
+		if (!pd) {
+			of_node_put(np);
 			return -ENOMEM;
+		}
 
 		pd->genpd.name = np->name;
 		pd->base = base;

[PATCH 5/5] arm: add missing of_node_put

[Julia Lawall]

for_each_child_of_node performs an of_node_get on each iteration, so
a break out of the loop requires an of_node_put.

The semantic patch that fixes this problem is as follows
(http://coccinelle.lip6.fr):

// <smpl>
@@
expression root,e;
local idexpression child;
iterator name for_each_child_of_node;
@@

 for_each_child_of_node(root, child) {
   ... when != of_node_put(child)
       when != e = child
+  of_node_put(child);
?  break;
   ...
}
... when != child
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>

---
 arch/arm/kernel/devtree.c |    1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/kernel/devtree.c b/arch/arm/kernel/devtree.c
index 11c54de..432ff34 100644
--- a/arch/arm/kernel/devtree.c
+++ b/arch/arm/kernel/devtree.c
@@ -143,6 +143,7 @@ void __init arm_dt_init_cpu_maps(void)
 					       "max cores %u, capping them\n",
 					       cpuidx, nr_cpu_ids)) {
 			cpuidx = nr_cpu_ids;
+			of_node_put(cpu);
 			break;
 		}
 

[PATCH 5/5] arm: add missing of_node_put

[Arnd Bergmann]

On Saturday 10 October 2015 14:30:54 Julia Lawall wrote:
> diff --git a/arch/arm/kernel/devtree.c b/arch/arm/kernel/devtree.c
> index 11c54de..432ff34 100644
> --- a/arch/arm/kernel/devtree.c
> +++ b/arch/arm/kernel/devtree.c
> @@ -143,6 +143,7 @@ void __init arm_dt_init_cpu_maps(void)
>                                                "max cores %u, capping them\n",
>                                                cpuidx, nr_cpu_ids)) {
>                         cpuidx = nr_cpu_ids;
> +                       of_node_put(cpu);
>                         break;
>                 }
> 

The same for_each_child_of_node() loop has three 'return' statements'
aside from the 'break' statement here. I think you should change your
semantic patch to cover both cases.

	Arnd

[PATCH 5/5] arm: add missing of_node_put

[Thomas Petazzoni]

Arnd,

On Sat, 10 Oct 2015 23:02:15 +0200, Arnd Bergmann wrote:

> The same for_each_child_of_node() loop has three 'return' statements'
> aside from the 'break' statement here. I think you should change your
> semantic patch to cover both cases.

I think Julia's semantic patch covers both cases, but only the cases
where there is one break or return (though I have essentially zero
Coccinelle knowledge, this is all based on guessing looking at the
semantic patch in the cover letter).

Thomas
-- 
Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com

[PATCH 5/5] arm: add missing of_node_put

[Julia Lawall]

On Sat, 10 Oct 2015, Arnd Bergmann wrote:

> On Saturday 10 October 2015 14:30:54 Julia Lawall wrote:
> > diff --git a/arch/arm/kernel/devtree.c b/arch/arm/kernel/devtree.c
> > index 11c54de..432ff34 100644
> > --- a/arch/arm/kernel/devtree.c
> > +++ b/arch/arm/kernel/devtree.c
> > @@ -143,6 +143,7 @@ void __init arm_dt_init_cpu_maps(void)
> >                                                "max cores %u, capping them\n",
> >                                                cpuidx, nr_cpu_ids)) {
> >                         cpuidx = nr_cpu_ids;
> > +                       of_node_put(cpu);
> >                         break;
> >                 }
> > 
> 
> The same for_each_child_of_node() loop has three 'return' statements'
> aside from the 'break' statement here. I think you should change your
> semantic patch to cover both cases.

It was intended to, but it seems that it's not working on the case where 
there is no argument to return.

In any case, it's an opportunity to ask a question.  Would one want a 
of_node_put in front of every return, or should the returns become gotos, 
to a single of_node_put after the current end of the function?

julia

[PATCH 5/5] arm: add missing of_node_put

[Julia Lawall]

On Sat, 10 Oct 2015, Thomas Petazzoni wrote:

> Arnd,
> 
> On Sat, 10 Oct 2015 23:02:15 +0200, Arnd Bergmann wrote:
> 
> > The same for_each_child_of_node() loop has three 'return' statements'
> > aside from the 'break' statement here. I think you should change your
> > semantic patch to cover both cases.
> 
> I think Julia's semantic patch covers both cases, but only the cases
> where there is one break or return (though I have essentially zero
> Coccinelle knowledge, this is all based on guessing looking at the
> semantic patch in the cover letter).

Normally, it should be OK with lots of returns.  And contrary to my 
previous email, even with return;.  Will check on it.

julia

[PATCH 5/5] arm: add missing of_node_put

[Arnd Bergmann]

On Saturday 10 October 2015 23:10:06 Julia Lawall wrote:
> On Sat, 10 Oct 2015, Arnd Bergmann wrote:
> 
> > On Saturday 10 October 2015 14:30:54 Julia Lawall wrote:
> > > diff --git a/arch/arm/kernel/devtree.c b/arch/arm/kernel/devtree.c
> > > index 11c54de..432ff34 100644
> > > --- a/arch/arm/kernel/devtree.c
> > > +++ b/arch/arm/kernel/devtree.c
> > > @@ -143,6 +143,7 @@ void __init arm_dt_init_cpu_maps(void)
> > >                                                "max cores %u, capping them\n",
> > >                                                cpuidx, nr_cpu_ids)) {
> > >                         cpuidx = nr_cpu_ids;
> > > +                       of_node_put(cpu);
> > >                         break;
> > >                 }
> > > 
> > 
> > The same for_each_child_of_node() loop has three 'return' statements'
> > aside from the 'break' statement here. I think you should change your
> > semantic patch to cover both cases.
> 
> It was intended to,

Ok, I saw that just after replying...

> but it seems that it's not working on the case where 
> there is no argument to return.

> In any case, it's an opportunity to ask a question.  Would one want a 
> of_node_put in front of every return, or should the returns become gotos, 
> to a single of_node_put after the current end of the function?

The two styles that I see in code I consider particularly clean are:

- have only one return statement in the function and use goto for
  error handling

- avoid the goto and have the early return.

Mixing the two tends to make the function less readable, so I'd only
change it to use gotos if it can be done nicely for all cases.

	Arnd

[PATCH 5/5 v2] arm: add missing of_node_put

[Julia Lawall]

for_each_child_of_node performs an of_node_get on each iteration, so
a break out of the loop requires an of_node_put.

The of_node_put is duplicated in front of each error return, because the
function contains a later error return that is beyond the end of the
for_each_child_of_node and thus doesn't need of_node_put.

The semantic patch that fixes this problem is as follows
(http://coccinelle.lip6.fr):

// <smpl>
@@
expression root,e;
local idexpression child;
iterator name for_each_child_of_node;
@@

 for_each_child_of_node(root, child) {
   ... when != of_node_put(child)
       when != e = child
(
   return child;
|
+  of_node_put(child);
?  return ...;
)
   ...
 }

@@
expression root,e;
local idexpression child;
@@

 for_each_child_of_node(root, child) {
   ... when != of_node_put(child)
       when != e = child
+  of_node_put(child);
?  break;
   ...
}
... when != child
// </smpl>

Additionally, concatenated a string in an affected line to avoid introducing
a checkpatch warning.

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>

---

v2: Fixed the returns as well, adjusted a string in a test expression.

 arch/arm/kernel/devtree.c |   12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/arch/arm/kernel/devtree.c b/arch/arm/kernel/devtree.c
index 11c54de..65addcb 100644
--- a/arch/arm/kernel/devtree.c
+++ b/arch/arm/kernel/devtree.c
@@ -101,6 +101,7 @@ void __init arm_dt_init_cpu_maps(void)
 		if (of_property_read_u32(cpu, "reg", &hwid)) {
 			pr_debug(" * %s missing reg property\n",
 				     cpu->full_name);
+			of_node_put(cpu);
 			return;
 		}
 
@@ -108,8 +109,10 @@ void __init arm_dt_init_cpu_maps(void)
 		 * 8 MSBs must be set to 0 in the DT since the reg property
 		 * defines the MPIDR[23:0].
 		 */
-		if (hwid & ~MPIDR_HWID_BITMASK)
+		if (hwid & ~MPIDR_HWID_BITMASK) {
+			of_node_put(cpu);
 			return;
+		}
 
 		/*
 		 * Duplicate MPIDRs are a recipe for disaster.
@@ -119,9 +122,11 @@ void __init arm_dt_init_cpu_maps(void)
 		 * to avoid matching valid MPIDR[23:0] values.
 		 */
 		for (j = 0; j < cpuidx; j++)
-			if (WARN(tmp_map[j] == hwid, "Duplicate /cpu reg "
-						     "properties in the DT\n"))
+			if (WARN(tmp_map[j] == hwid,
+				 "Duplicate /cpu reg properties in the DT\n")) {
+				of_node_put(cpu);
 				return;
+			}
 
 		/*
 		 * Build a stashed array of MPIDR values. Numbering scheme
@@ -143,6 +148,7 @@ void __init arm_dt_init_cpu_maps(void)
 					       "max cores %u, capping them\n",
 					       cpuidx, nr_cpu_ids)) {
 			cpuidx = nr_cpu_ids;
+			of_node_put(cpu);
 			break;
 		}
 

[PATCH 3/5] ARM: shmobile: R-Mobile: add missing of_node_put

[Simon Horman]

On Sat, Oct 10, 2015 at 02:30:52PM +0200, Julia Lawall wrote:
> for_each_child_of_node performs an of_node_get on each iteration, so
> a break out of the loop requires an of_node_put.
> 
> The semantic patch that fixes this problem is as follows
> (http://coccinelle.lip6.fr):
> 
> // <smpl>
> @@
> expression root,e;
> local idexpression child;
> @@
> 
>  for_each_child_of_node(root, child) {
>    ... when != of_node_put(child)
>        when != e = child
> (
>    return child;
> |
> +  of_node_put(child);
> ?  return ...;
> )
>    ...
>  }
> // </smpl>
> 
> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>

Thanks, I have queued this up as a cleanup for v4.4.

[PATCH 3/5] ARM: shmobile: R-Mobile: add missing of_node_put

[Geert Uytterhoeven]

Hi Julia,

On Sat, Oct 10, 2015 at 2:30 PM, Julia Lawall <Julia.Lawall@lip6.fr> wrote:
> --- a/arch/arm/mach-shmobile/pm-rmobile.c
> +++ b/arch/arm/mach-shmobile/pm-rmobile.c
> @@ -313,8 +313,10 @@ static int __init rmobile_add_pm_domains(void __iomem *base,
>                 }
>
>                 pd = kzalloc(sizeof(*pd), GFP_KERNEL);
> -               if (!pd)
> +               if (!pd) {
> +                       of_node_put(np);
>                         return -ENOMEM;
> +               }

While technically this patch is correct, the system will be dead anyway if it
ever goes OOM at core_initcall() time.

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert at linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds

[PATCH 3/5] ARM: shmobile: R-Mobile: add missing of_node_put

[Julia Lawall]

On Mon, 12 Oct 2015, Geert Uytterhoeven wrote:

> Hi Julia,
>
> On Sat, Oct 10, 2015 at 2:30 PM, Julia Lawall <Julia.Lawall@lip6.fr> wrote:
> > --- a/arch/arm/mach-shmobile/pm-rmobile.c
> > +++ b/arch/arm/mach-shmobile/pm-rmobile.c
> > @@ -313,8 +313,10 @@ static int __init rmobile_add_pm_domains(void __iomem *base,
> >                 }
> >
> >                 pd = kzalloc(sizeof(*pd), GFP_KERNEL);
> > -               if (!pd)
> > +               if (!pd) {
> > +                       of_node_put(np);
> >                         return -ENOMEM;
> > +               }
>
> While technically this patch is correct, the system will be dead anyway if it
> ever goes OOM at core_initcall() time.

Maybe it would be better for the code to be correct to serve as an example
(or to avoid serving as a bad example) for others?

julia

[PATCH 3/5] ARM: shmobile: R-Mobile: add missing of_node_put

[Geert Uytterhoeven]

Hi Julia,

On Mon, Oct 12, 2015 at 9:24 AM, Julia Lawall <julia.lawall@lip6.fr> wrote:
> On Mon, 12 Oct 2015, Geert Uytterhoeven wrote:
>> On Sat, Oct 10, 2015 at 2:30 PM, Julia Lawall <Julia.Lawall@lip6.fr> wrote:
>> > --- a/arch/arm/mach-shmobile/pm-rmobile.c
>> > +++ b/arch/arm/mach-shmobile/pm-rmobile.c
>> > @@ -313,8 +313,10 @@ static int __init rmobile_add_pm_domains(void __iomem *base,
>> >                 }
>> >
>> >                 pd = kzalloc(sizeof(*pd), GFP_KERNEL);
>> > -               if (!pd)
>> > +               if (!pd) {
>> > +                       of_node_put(np);
>> >                         return -ENOMEM;
>> > +               }
>>
>> While technically this patch is correct, the system will be dead anyway if it
>> ever goes OOM at core_initcall() time.
>
> Maybe it would be better for the code to be correct to serve as an example
> (or to avoid serving as a bad example) for others?

Sure, as it's only a single call, that's fine for me.

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert at linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds

[PATCH 3/5] ARM: shmobile: R-Mobile: add missing of_node_put

[Thomas Petazzoni]

Dear Geert Uytterhoeven,

On Mon, 12 Oct 2015 09:18:52 +0200, Geert Uytterhoeven wrote:

> >                 pd = kzalloc(sizeof(*pd), GFP_KERNEL);
> > -               if (!pd)
> > +               if (!pd) {
> > +                       of_node_put(np);
> >                         return -ENOMEM;
> > +               }
> 
> While technically this patch is correct, the system will be dead anyway if it
> ever goes OOM at core_initcall() time.

Then BUG_ON(!pd); ?

Thomas
-- 
Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com

[PATCH 3/5] ARM: shmobile: R-Mobile: add missing of_node_put

[Geert Uytterhoeven]

On Mon, Oct 12, 2015 at 9:29 AM, Thomas Petazzoni
<thomas.petazzoni@free-electrons.com> wrote:
> On Mon, 12 Oct 2015 09:18:52 +0200, Geert Uytterhoeven wrote:
>
>> >                 pd = kzalloc(sizeof(*pd), GFP_KERNEL);
>> > -               if (!pd)
>> > +               if (!pd) {
>> > +                       of_node_put(np);
>> >                         return -ENOMEM;
>> > +               }
>>
>> While technically this patch is correct, the system will be dead anyway if it
>> ever goes OOM at core_initcall() time.
>
> Then BUG_ON(!pd); ?

kzalloc() will scream anyway.

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert at linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds