[PATCH 0/2] mtd: rawnand: fix GPIO CS descriptor leaks

[PATCH 0/2] mtd: rawnand: fix GPIO CS descriptor leaks

[Zhao Feng]

Two related fixes for GPIO chip-select descriptor leaks in the raw
NAND core helper and its in-tree user, the Arasan controller driver:

- patch 1 rolls back the already-acquired GPIO descriptors when
  rawnand_dt_parse_gpio_cs() fails midway through the cs-gpios array;
- patch 2 releases the parsed CS array on the arasan probe error
  paths (invalid DT layout and anfc_chips_init() failure), factoring
  the remove-time gpiod_put() loop into a shared helper.

Both issues date back to the gpio-cs support merged in 2021 and are
still present in current master.  Not runtime-tested (no hardware).

Zhao Feng (2):
  mtd: rawnand: fix GPIO descriptor leak in rawnand_dt_parse_gpio_cs()
  mtd: rawnand: arasan: fix GPIO CS leak on probe error paths

 drivers/mtd/nand/raw/arasan-nand-controller.c | 26 +++++++++++++++----
 drivers/mtd/nand/raw/nand_base.c              | 12 +++++++---
 2 files changed, 27 insertions(+), 11 deletions(-)

-- 
2.39.2




______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

[PATCH 1/2] mtd: rawnand: fix GPIO descriptor leak in rawnand_dt_parse_gpio_cs()

[Zhao Feng]

rawnand_dt_parse_gpio_cs() acquires one GPIO descriptor per loop
iteration with gpiod_get_index_optional().  If a later iteration
fails, the descriptors acquired so far are never released, leaking
the GPIO references.

Roll back with gpiod_put() on the error path.  gpiod_put() accepts
NULL, so the NULL slots left by absent optional GPIOs need no special
casing.

Fixes: b85c943d181a ("mtd: rawnand: Add a helper to parse the gpio-cs DT property")
Cc: stable@vger.kernel.org
Signed-off-by: Zhao Feng <zhaofeng2@cmss.chinamobile.com>
---
Verified against current upstream master.  Not runtime-tested (no
hardware using gpio-cs).

 drivers/mtd/nand/raw/nand_base.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c
--- a/drivers/mtd/nand/raw/nand_base.c
+++ b/drivers/mtd/nand/raw/nand_base.c
@@ -5466,7 +5466,7 @@ int rawnand_dt_parse_gpio_cs(struct device *dev, struct gpio_desc ***cs_array,
 			     unsigned int *ncs_array)
 {
 	struct gpio_desc **descs;
-	int ndescs, i;
+	int ndescs, i, ret;
 
 	ndescs = gpiod_count(dev, "cs");
 	if (ndescs < 0) {
@@ -5481,8 +5481,14 @@ int rawnand_dt_parse_gpio_cs(struct device *dev, struct gpio_desc ***cs_array,
 	for (i = 0; i < ndescs; i++) {
 		descs[i] = gpiod_get_index_optional(dev, "cs", i,
 						    GPIOD_OUT_HIGH);
-		if (IS_ERR(descs[i]))
-			return PTR_ERR(descs[i]);
+		if (IS_ERR(descs[i])) {
+			ret = PTR_ERR(descs[i]);
+
+			while (--i >= 0)
+				gpiod_put(descs[i]);
+
+			return ret;
+		}
 	}
 
 	*ncs_array = ndescs;
-- 
2.39.2




______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

[PATCH 2/2] mtd: rawnand: arasan: fix GPIO CS leak on probe error paths

[Zhao Feng]

The CS GPIO descriptors acquired by anfc_parse_cs() via
rawnand_dt_parse_gpio_cs() are only released in anfc_remove().  Two
probe error paths leak them:

- anfc_parse_cs() itself returns -EINVAL on an invalid DT GPIO CS
  layout without releasing the freshly acquired descriptors;
- anfc_probe() bails out when anfc_chips_init() fails, leaving the
  successfully parsed CS array behind.

Factor the gpiod_put() loop of anfc_remove() into anfc_put_cs() and
call it from both error paths as well.  gpiod_put() accepts NULL, so
this is also safe when the default all-NULL CS array is in place.

Fixes: acbd3d0945f9 ("mtd: rawnand: arasan: Leverage additional GPIO CS")
Cc: stable@vger.kernel.org
Signed-off-by: Zhao Feng <zhaofeng2@cmss.chinamobile.com>
---
Verified against current upstream master.  Not runtime-tested (no
Arasan hardware).

 drivers/mtd/nand/raw/arasan-nand-controller.c | 26 ++++++++++++++----
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/drivers/mtd/nand/raw/arasan-nand-controller.c b/drivers/mtd/nand/raw/arasan-nand-controller.c
--- a/drivers/mtd/nand/raw/arasan-nand-controller.c
+++ b/drivers/mtd/nand/raw/arasan-nand-controller.c
@@ -1391,6 +1391,14 @@ static void anfc_reset(struct arasan_nfc *nfc)
 
 	nfc->cur_cs = -1;
 }
 
+static void anfc_put_cs(struct arasan_nfc *nfc)
+{
+	int i;
+
+	for (i = 0; i < nfc->ncs; i++)
+		gpiod_put(nfc->cs_array[i]);
+}
+
 static int anfc_parse_cs(struct arasan_nfc *nfc)
 {
@@ -1413,7 +1421,9 @@ static int anfc_parse_cs(struct arasan_nfc *nfc)
 		if (nfc->ncs > 2 && !nfc->cs_array[0] && !nfc->cs_array[1]) {
 			dev_err(nfc->dev,
 				"Assign a single native CS when using GPIOs\n");
+			anfc_put_cs(nfc);
+
 			return -EINVAL;
 		}
 
 		if (nfc->cs_array[0])
@@ -1469,23 +1479,23 @@ static int anfc_probe(struct platform_device *pdev)
 
 	ret = anfc_chips_init(nfc);
 	if (ret)
-		return ret;
+		goto err_put_cs;
 
 	platform_set_drvdata(pdev, nfc);
 
 	return 0;
+
+err_put_cs:
+	anfc_put_cs(nfc);
+
+	return ret;
 }
 
 static void anfc_remove(struct platform_device *pdev)
 {
-	int i;
 	struct arasan_nfc *nfc = platform_get_drvdata(pdev);
 
-	for (i = 0; i < nfc->ncs; i++) {
-		if (nfc->cs_array[i]) {
-			gpiod_put(nfc->cs_array[i]);
-		}
-	}
-
+	anfc_put_cs(nfc);
+
 	anfc_chips_cleanup(nfc);
 }
-- 
2.39.2




______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

Re: [PATCH 1/2] mtd: rawnand: fix GPIO descriptor leak in rawnand_dt_parse_gpio_cs()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Medium] mtd: rawnand: arasan: GPIO descriptor leak in anfc_probe()
  and anfc_parse_cs() [1]
--

commit 15f3589a1d2a790f1885eb5bb428694b51898fd3
Author: Zhao Feng <zhaofeng2@cmss.chinamobile.com>

mtd: rawnand: fix GPIO descriptor leak in rawnand_dt_parse_gpio_cs()

This commit releases previously acquired GPIO descriptors with gpiod_put()
if gpiod_get_index_optional() fails during the loop in
rawnand_dt_parse_gpio_cs().

> diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c
> index a5b278ab9384f..fa923ef96262a 100644
> --- a/drivers/mtd/nand/raw/nand_base.c
> +++ b/drivers/mtd/nand/raw/nand_base.c
> @@ -5466,7 +5466,7 @@ int rawnand_dt_parse_gpio_cs(struct device *dev, struct gpio_desc ***cs_array,
>  			     unsigned int *ncs_array)
>  {
>  	struct gpio_desc **descs;
> -	int ndescs, i;
> +	int ndescs, i, ret;
>  
>  	ndescs = gpiod_count(dev, "cs");
>  	if (ndescs < 0) {
> @@ -5481,8 +5481,14 @@ int rawnand_dt_parse_gpio_cs(struct device *dev, struct gpio_desc ***cs_array,
>  	for (i = 0; i < ndescs; i++) {
>  		descs[i] = gpiod_get_index_optional(dev, "cs", i,
>  						    GPIOD_OUT_HIGH);
> -		if (IS_ERR(descs[i]))
> -			return PTR_ERR(descs[i]);
> +		if (IS_ERR(descs[i])) {
> +			ret = PTR_ERR(descs[i]);
> +
> +			while (--i >= 0)
> +				gpiod_put(descs[i]);
> +
> +			return ret;
> +		}
>  	}

[Severity: Medium]
This problem wasn't introduced by this patch, but can its caller leak the
same nfc->cs_array GPIO descriptors [1] when probe fails after
rawnand_dt_parse_gpio_cs() succeeds?

Because rawnand_dt_parse_gpio_cs() uses unmanaged gpiod_get_index_optional(),
those descriptors are only released in anfc_remove():

drivers/mtd/nand/raw/arasan-nand-controller.c:anfc_parse_cs() {
	ret = rawnand_dt_parse_gpio_cs(nfc->dev, &nfc->cs_array, &nfc->ncs);
	if (ret)
		return ret;
	...
	if (nfc->cs_array) {
		if (nfc->ncs > 2 && !nfc->cs_array[0] && !nfc->cs_array[1]) {
			dev_err(nfc->dev,
				"Assign a single native CS when using GPIOs\n");
			return -EINVAL;
		}
}

If the native chip-select check in anfc_parse_cs() or a subsequent call to
anfc_chips_init() in anfc_probe() fails, the GPIO lines remain requested and
cause later probe attempts to fail with -EBUSY.  Switching to
devm_gpiod_get_index_optional() (and dropping the manual gpiod_put() loop in
anfc_remove()) would avoid leaking descriptors in both places.

[1] https://sashiko.dev/#/bug/linux-59d8a6d4-32bb-4a7d-8008-c2c272081e11

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109052724.1032-1-zhaofeng2@cmss.chinamobile.com?part=1

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/