[PATCH] of/platform: increase refcount of fwnode

[PATCH] of/platform: increase refcount of fwnode

[Peng Fan (OSS)]

From: Peng Fan <peng.fan@nxp.com>

commit 0f8e5651095b
("of/platform: Propagate firmware node by calling device_set_node()")
use of_fwnode_handle to replace of_node_get, which introduces a side
effect that the refcount is not increased. Then the out of tree
jailhouse hypervisor enable/disable test will trigger kernel dump in
of_overlay_remove, with the following sequence
"
   of_changeset_revert(&overlay_changeset);
   of_changeset_destroy(&overlay_changeset);
   of_overlay_remove(&overlay_id);
"

So increase the refcount to avoid issues.

Fixes: 0f8e5651095b ("of/platform: Propagate firmware node by calling device_set_node()")
Signed-off-by: Peng Fan <peng.fan@nxp.com>
---
 drivers/of/platform.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 0c3475e7d2ff..4659ff5a79c8 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -113,6 +113,7 @@ struct platform_device *of_device_alloc(struct device_node *np,
 				  const char *bus_id,
 				  struct device *parent)
 {
+	struct fwnode_handle *fwnode = of_fwnode_handle(np);
 	struct platform_device *dev;
 	int rc, i, num_reg = 0;
 	struct resource *res;
@@ -141,7 +142,7 @@ struct platform_device *of_device_alloc(struct device_node *np,
 	}
 
 	/* setup generic device info */
-	device_set_node(&dev->dev, of_fwnode_handle(np));
+	device_set_node(&dev->dev, fwnode_handle_get(fwnode));
 	dev->dev.parent = parent ? : &platform_bus;
 
 	if (bus_id)
@@ -221,6 +222,7 @@ static struct amba_device *of_amba_device_create(struct device_node *node,
 						 void *platform_data,
 						 struct device *parent)
 {
+	struct fwnode_handle *fwnode = of_fwnode_handle(node);
 	struct amba_device *dev;
 	int ret;
 
@@ -239,7 +241,7 @@ static struct amba_device *of_amba_device_create(struct device_node *node,
 	dev->dev.dma_mask = &dev->dev.coherent_dma_mask;
 
 	/* setup generic device info */
-	device_set_node(&dev->dev, of_fwnode_handle(node));
+	device_set_node(&dev->dev, fwnode_handle_get(fwnode));
 	dev->dev.parent = parent ? : &platform_bus;
 	dev->dev.platform_data = platform_data;
 	if (bus_id)
-- 
2.37.1

Re: [PATCH] of/platform: increase refcount of fwnode

[Andy Shevchenko]

On Sat, Aug 12, 2023 at 08:24:11PM +0800, Peng Fan (OSS) wrote:
> From: Peng Fan <peng.fan@nxp.com>
> 
> commit 0f8e5651095b
> ("of/platform: Propagate firmware node by calling device_set_node()")
> use of_fwnode_handle to replace of_node_get, which introduces a side
> effect that the refcount is not increased. Then the out of tree
> jailhouse hypervisor enable/disable test will trigger kernel dump in
> of_overlay_remove, with the following sequence
> "
>    of_changeset_revert(&overlay_changeset);
>    of_changeset_destroy(&overlay_changeset);
>    of_overlay_remove(&overlay_id);
> "
> 
> So increase the refcount to avoid issues.

Right, thank you for the report!
I was too busy to send myself a fix (I realized about the issue).
But what I think about this the actual platform code has to be balanced with
this. I dunno why we have OF code do one part and the platform core do the
other. It's not obvious and prone to mistakes (like I made).

Let me look to this closer.

-- 
With Best Regards,
Andy Shevchenko

RE: [PATCH] of/platform: increase refcount of fwnode

[Peng Fan]

Hi Andy

> Subject: Re: [PATCH] of/platform: increase refcount of fwnode
> 
> On Sat, Aug 12, 2023 at 08:24:11PM +0800, Peng Fan (OSS) wrote:
> > From: Peng Fan <peng.fan@nxp.com>
> >
> > commit 0f8e5651095b
> > ("of/platform: Propagate firmware node by calling device_set_node()")
> > use of_fwnode_handle to replace of_node_get, which introduces a side
> > effect that the refcount is not increased. Then the out of tree
> > jailhouse hypervisor enable/disable test will trigger kernel dump in
> > of_overlay_remove, with the following sequence "
> >    of_changeset_revert(&overlay_changeset);
> >    of_changeset_destroy(&overlay_changeset);
> >    of_overlay_remove(&overlay_id);
> > "
> >
> > So increase the refcount to avoid issues.
> 
> Right, thank you for the report!
> I was too busy to send myself a fix (I realized about the issue).
> But what I think about this the actual platform code has to be balanced with
> this. I dunno why we have OF code do one part and the platform core do
> the other. 

No idea, Rob may comment.

It's not obvious and prone to mistakes (like I made).
> 
> Let me look to this closer.

It is 6.5-rc6 now, I hope we could land a fix. If you have better fix, that
would be great.

Thanks,
Peng.

> 
> --
> With Best Regards,
> Andy Shevchenko
> 

Re: [PATCH] of/platform: increase refcount of fwnode

[Andy Shevchenko]

On Sat, Aug 12, 2023 at 08:24:11PM +0800, Peng Fan (OSS) wrote:
> From: Peng Fan <peng.fan@nxp.com>
> 
> commit 0f8e5651095b
> ("of/platform: Propagate firmware node by calling device_set_node()")
> use of_fwnode_handle to replace of_node_get, which introduces a side
> effect that the refcount is not increased. Then the out of tree
> jailhouse hypervisor enable/disable test will trigger kernel dump in
> of_overlay_remove, with the following sequence
> "
>    of_changeset_revert(&overlay_changeset);
>    of_changeset_destroy(&overlay_changeset);
>    of_overlay_remove(&overlay_id);
> "
> 
> So increase the refcount to avoid issues.

I was thinking about this and it's kind quite a tricky thing.
So, let's go with your patch after some modifications, see below.

With that, feel free to add
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

...

> -	device_set_node(&dev->dev, of_fwnode_handle(np));
> +	device_set_node(&dev->dev, fwnode_handle_get(fwnode));

We know that we only handle OF node here, let's not involve other APIs,
so

	device_set_node(&dev->dev, of_fwnode_handle(of_node_get(np)));

...

> -	device_set_node(&dev->dev, of_fwnode_handle(node));
> +	device_set_node(&dev->dev, fwnode_handle_get(fwnode));

Ditto.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH] of/platform: increase refcount of fwnode

[Andy Shevchenko]

On Thu, Aug 17, 2023 at 01:57:39PM +0300, Andy Shevchenko wrote:
> On Sat, Aug 12, 2023 at 08:24:11PM +0800, Peng Fan (OSS) wrote:

...

> > -	device_set_node(&dev->dev, of_fwnode_handle(node));
> > +	device_set_node(&dev->dev, fwnode_handle_get(fwnode));
> 
> Ditto.

Actually no, amba_device_alloc() does not use platform_device_alloc() and
defines it's own .release method. There is no reference count drop there
AFAICS.

-- 
With Best Regards,
Andy Shevchenko

RE: [PATCH] of/platform: increase refcount of fwnode

[Peng Fan]

> Subject: Re: [PATCH] of/platform: increase refcount of fwnode
> 
> On Thu, Aug 17, 2023 at 01:57:39PM +0300, Andy Shevchenko wrote:
> > On Sat, Aug 12, 2023 at 08:24:11PM +0800, Peng Fan (OSS) wrote:
> 
> ...
> 
> > > -	device_set_node(&dev->dev, of_fwnode_handle(node));
> > > +	device_set_node(&dev->dev, fwnode_handle_get(fwnode));
> >
> > Ditto.
> 
> Actually no, amba_device_alloc() does not use platform_device_alloc() and
> defines it's own .release method. There is no reference count drop there
> AFAICS.

My test only covers platform device, so ..

But I have a general question here. Since of_amba_device_create will use
the of_node or fwnode, shouldn't the refcount_t be increased and released
in amba device release?

Thanks,
Peng.

> 
> --
> With Best Regards,
> Andy Shevchenko
> 

Re: [PATCH] of/platform: increase refcount of fwnode

[Andy Shevchenko]

On Thu, Aug 17, 2023 at 01:13:01PM +0000, Peng Fan wrote:
> > On Thu, Aug 17, 2023 at 01:57:39PM +0300, Andy Shevchenko wrote:
> > > On Sat, Aug 12, 2023 at 08:24:11PM +0800, Peng Fan (OSS) wrote:

...

> > > > -	device_set_node(&dev->dev, of_fwnode_handle(node));
> > > > +	device_set_node(&dev->dev, fwnode_handle_get(fwnode));
> > >
> > > Ditto.
> > 
> > Actually no, amba_device_alloc() does not use platform_device_alloc() and
> > defines it's own .release method. There is no reference count drop there
> > AFAICS.
> 
> My test only covers platform device, so ..
> 
> But I have a general question here. Since of_amba_device_create will use
> the of_node or fwnode, shouldn't the refcount_t be increased and released
> in amba device release?

I believe so.
Basically we need two changes:
1) this one with the suggested modifications, and
2) fix the reference count leak in amba release.

-- 
With Best Regards,
Andy Shevchenko