Re: [PATCH v11 02/12] spmi: Remove redundant dev_name() print in spmi_device_add()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Unbalanced of_node_put() in the error path of of_spmi_register_devices() leads to a double-put and use-after-free of the device node.
--

--- Patch [2]: [PATCH v11 02/12] spmi: Remove redundant dev_name() print in spmi_device_add() ---
commit f89306eb718cb1ef4d332962e10b5d601928293c
Author: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>

spmi: Remove redundant dev_name() print in spmi_device_add()

This commit removes redundant dev_name() prints from the debug and error
messages in spmi_device_add(). The dev_dbg() and dev_err() macros already
include the device name in their output, so explicitly printing it results
in duplication.

> diff --git a/drivers/spmi/spmi.c b/drivers/spmi/spmi.c
> index 293e1adddcd71..9bee0cb3d9dc1 100644
> --- a/drivers/spmi/spmi.c
> +++ b/drivers/spmi/spmi.c
> @@ -71,12 +71,11 @@ int spmi_device_add(struct spmi_device *sdev)
>  
>  	err = device_add(&sdev->dev);
>  	if (err < 0) {
> -		dev_err(&sdev->dev, "Can't add %s, status %d\n",
> -			dev_name(&sdev->dev), err);
> +		dev_err(&sdev->dev, "Can't add device, status %d\n", err);
>  		goto err_device_add;
>  	}

[Severity: High]
Does this error path trigger a double-put of the device node in
of_spmi_register_devices()?

When spmi_device_add() fails, it returns an error to
of_spmi_register_devices(), which handles the failure like this:

drivers/spmi/spmi.c:of_spmi_register_devices() {
    ...
		err = spmi_device_add(sdev);
		if (err) {
			dev_err(&sdev->dev,
				"failure adding device. status %d\n", err);
			of_node_put(node);
			spmi_device_put(sdev);
		}
    ...
}

Since a previous patch in this series updated spmi_dev_release() to also
call of_node_put(dev->of_node), wouldn't calling both of_node_put(node) and
spmi_device_put(sdev) drop the node reference twice?

This could consume the reference held by the
for_each_available_child_of_node() iterator, causing a use-after-free when
the iterator accesses node->sibling.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260707101821.173319-1-angelogioacchino.delregno@collabora.com?part=2

-- 
linux-phy mailing list
linux-phy@lists.infradead.org
https://lists.infradead.org/mailman/listinfo/linux-phy