[PATCH 0/3] PCI: keystone: Fix device node leaks in syscon phandle parsing

[PATCH 0/3] PCI: keystone: Fix device node leaks in syscon phandle parsing

[zhaofeng2]

From: Zhao Feng <zhaofeng2@cmss.chinamobile.com>

ks_pcie_init_id(), ks_pcie_set_mode() and ks_pcie_am654_set_mode()
resolve the "ti,syscon-pcie-id" / "ti,syscon-pcie-mode" phandles with
of_parse_phandle_with_fixed_args(), which takes a reference on the
syscon device node, but none of them drops that reference after the
register offset has been read from args.args[0], so the syscon node
is leaked on every probe.

All three call sites were introduced by the same commit, which
switched the driver from syscon_regmap_lookup_by_phandle() to
of_parse_phandle_with_fixed_args() in order to obtain the register
offset from the phandle argument.

[PATCH 1/3] PCI: keystone: Fix device node leak in ks_pcie_init_id()

[zhaofeng2]

From: Zhao Feng <zhaofeng2@cmss.chinamobile.com>

ks_pcie_init_id() resolves the "ti,syscon-pcie-id" phandle with
of_parse_phandle_with_fixed_args() to obtain the device-id register
offset, which takes a reference on the syscon device node, but the
reference is never dropped after the offset has been read from
args.args[0], so the syscon node is leaked on every probe.

Drop the reference with of_node_put() once the offset argument has
been consumed.

Fixes: 7dcf07ac8867 ("PCI: keystone: Use phandle argument from "ti,syscon-pcie-id"/"ti,syscon-pcie-mode"")
Signed-off-by: Zhao Feng <zhaofeng2@cmss.chinamobile.com>
---
 drivers/pci/controller/dwc/pci-keystone.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletions(-)

diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c
--- a/drivers/pci/controller/dwc/pci-keystone.c
+++ b/drivers/pci/controller/dwc/pci-keystone.c
@@ -795,8 +795,10 @@
 
 	/* Do not error out to maintain old DT compatibility */
 	ret = of_parse_phandle_with_fixed_args(np, "ti,syscon-pcie-id", 1, 0, &args);
-	if (!ret)
+	if (!ret) {
 		offset = args.args[0];
+		of_node_put(args.np);
+	}
 
 	ret = regmap_read(devctrl_regs, offset, &id);
 	if (ret)

Re: [PATCH 1/3] PCI: keystone: Fix device node leak in ks_pcie_init_id()

[sashiko-bot]

> From: Zhao Feng <zhaofeng2@cmss.chinamobile.com>
> 
> ks_pcie_init_id() resolves the "ti,syscon-pcie-id" phandle with
> of_parse_phandle_with_fixed_args() to obtain the device-id register
> offset, which takes a reference on the syscon device node, but the
> reference is never dropped after the offset has been read from
> args.args[0], so the syscon node is leaked on every probe.
> 
> Drop the reference with of_node_put() once the offset argument has
> been consumed.
> 
> Fixes: 7dcf07ac8867 ("PCI: keystone: Use phandle argument from "ti,syscon-pcie-id"/"ti,syscon-pcie-mode"")
> Signed-off-by: Zhao Feng <zhaofeng2@cmss.chinamobile.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110100955.1046-1-zhaofeng2@cmss.chinamobile.com?part=1

[PATCH 2/3] PCI: keystone: Fix device node leak in ks_pcie_set_mode()

[zhaofeng2]

From: Zhao Feng <zhaofeng2@cmss.chinamobile.com>

ks_pcie_set_mode() resolves the "ti,syscon-pcie-mode" phandle with
of_parse_phandle_with_fixed_args() to obtain the mode register
offset, which takes a reference on the syscon device node, but the
reference is never dropped after the offset has been read from
args.args[0], so the syscon node is leaked on every probe.

Drop the reference with of_node_put() once the offset argument has
been consumed.

Fixes: 7dcf07ac8867 ("PCI: keystone: Use phandle argument from "ti,syscon-pcie-id"/"ti,syscon-pcie-mode"")
Signed-off-by: Zhao Feng <zhaofeng2@cmss.chinamobile.com>
---
 drivers/pci/controller/dwc/pci-keystone.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletions(-)

diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c
--- a/drivers/pci/controller/dwc/pci-keystone.c
+++ b/drivers/pci/controller/dwc/pci-keystone.c
@@ -1027,8 +1027,10 @@
 
 	/* Do not error out to maintain old DT compatibility */
 	ret = of_parse_phandle_with_fixed_args(np, "ti,syscon-pcie-mode", 1, 0, &args);
-	if (!ret)
+	if (!ret) {
 		offset = args.args[0];
+		of_node_put(args.np);
+	}
 
 	mask = KS_PCIE_DEV_TYPE_MASK | KS_PCIE_SYSCLOCKOUTEN;
 	val = KS_PCIE_DEV_TYPE(RC) | KS_PCIE_SYSCLOCKOUTEN;

Re: [PATCH 2/3] PCI: keystone: Fix device node leak in ks_pcie_set_mode()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Medium] PCI: keystone: OF node leak in ks_pcie_init_id() [1]
--

commit adfea56e642f99fd836f33feabf3e85f9ea278a1
Author: Zhao Feng <zhaofeng2@cmss.chinamobile.com>

PCI: keystone: Fix device node leak in ks_pcie_set_mode()

This commit adds an of_node_put() call in ks_pcie_set_mode() to drop the
syscon device node reference acquired by
of_parse_phandle_with_fixed_args().

> diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c
> index 832589152570a..12c6f7d9a64bf 100644
> --- a/drivers/pci/controller/dwc/pci-keystone.c
> +++ b/drivers/pci/controller/dwc/pci-keystone.c
> @@ -1029,8 +1029,10 @@ static int ks_pcie_set_mode(struct device *dev)
>  
>  	/* Do not error out to maintain old DT compatibility */
>  	ret = of_parse_phandle_with_fixed_args(np, "ti,syscon-pcie-mode", 1, 0, &args);
> -	if (!ret)
> +	if (!ret) {
>  		offset = args.args[0];
> +		of_node_put(args.np);
> +	}

[Severity: Medium]
This problem wasn't introduced by this patch, but does the same
args.np device node reference leak [1] remain in ks_pcie_init_id()
and ks_pcie_am654_set_mode()?  Both functions also call
of_parse_phandle_with_fixed_args() to read args.args[0] without calling
of_node_put(args.np), leaking the syscon node reference on probe.

[1] https://sashiko.dev/#/bug/linux-2281dc7f-5c66-431f-8423-64e501436da0

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110100955.1046-1-zhaofeng2@cmss.chinamobile.com?part=2

[PATCH 3/3] PCI: keystone: Fix device node leak in ks_pcie_am654_set_mode()

[zhaofeng2]

From: Zhao Feng <zhaofeng2@cmss.chinamobile.com>

ks_pcie_am654_set_mode() resolves the "ti,syscon-pcie-mode" phandle
with of_parse_phandle_with_fixed_args() to obtain the mode register
offset, which takes a reference on the syscon device node, but the
reference is never dropped after the offset has been read from
args.args[0], so the syscon node is leaked on every probe.

Drop the reference with of_node_put() once the offset argument has
been consumed.

Fixes: 7dcf07ac8867 ("PCI: keystone: Use phandle argument from "ti,syscon-pcie-id"/"ti,syscon-pcie-mode"")
Signed-off-by: Zhao Feng <zhaofeng2@cmss.chinamobile.com>
---
 drivers/pci/controller/dwc/pci-keystone.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletions(-)

diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c
--- a/drivers/pci/controller/dwc/pci-keystone.c
+++ b/drivers/pci/controller/dwc/pci-keystone.c
@@ -1059,8 +1059,10 @@
 
 	/* Do not error out to maintain old DT compatibility */
 	ret = of_parse_phandle_with_fixed_args(np, "ti,syscon-pcie-mode", 1, 0, &args);
-	if (!ret)
+	if (!ret) {
 		offset = args.args[0];
+		of_node_put(args.np);
+	}
 
 	mask = AM654_PCIE_DEV_TYPE_MASK;
 

Re: [PATCH 3/3] PCI: keystone: Fix device node leak in ks_pcie_am654_set_mode()

[sashiko-bot]

> From: Zhao Feng <zhaofeng2@cmss.chinamobile.com>
> 
> ks_pcie_am654_set_mode() resolves the "ti,syscon-pcie-mode" phandle
> with of_parse_phandle_with_fixed_args() to obtain the mode register
> offset, which takes a reference on the syscon device node, but the
> reference is never dropped after the offset has been read from
> args.args[0], so the syscon node is leaked on every probe.
> 
> Drop the reference with of_node_put() once the offset argument has
> been consumed.
> 
> Fixes: 7dcf07ac8867 ("PCI: keystone: Use phandle argument from "ti,syscon-pcie-id"/"ti,syscon-pcie-mode"")
> Signed-off-by: Zhao Feng <zhaofeng2@cmss.chinamobile.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110100955.1046-1-zhaofeng2@cmss.chinamobile.com?part=3