[PATCH] cpufreq: dt: fix potential double put of cpu OF node

[PATCH] cpufreq: dt: fix potential double put of cpu OF node

[Lucas Stach]

If cpufreq_generic_init() fails we jump into the resource
cleanup path which contains a of_node_put() call. Another
instance of this has already been called at that time
resulting a double decrement of the refcount.

Fix this by calling of_node_put() only after we are sure
that nothing has gone wrong.

Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
---
 drivers/cpufreq/cpufreq-dt.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/cpufreq/cpufreq-dt.c b/drivers/cpufreq/cpufreq-dt.c
index e00265066a75..6bbb8b913446 100644
--- a/drivers/cpufreq/cpufreq-dt.c
+++ b/drivers/cpufreq/cpufreq-dt.c
@@ -259,7 +259,6 @@ static int cpufreq_init(struct cpufreq_policy *policy)
 		else
 			priv->cdev = cdev;
 	}
-	of_node_put(np);
 
 	priv->cpu_dev = cpu_dev;
 	priv->cpu_reg = cpu_reg;
@@ -270,6 +269,8 @@ static int cpufreq_init(struct cpufreq_policy *policy)
 	if (ret)
 		goto out_cooling_unregister;
 
+	of_node_put(np);
+
 	return 0;
 
 out_cooling_unregister:
-- 
2.1.0

Re: [PATCH] cpufreq: dt: fix potential double put of cpu OF node

[Rafael J. Wysocki]

On Friday, September 26, 2014 03:33:46 PM Lucas Stach wrote:
> If cpufreq_generic_init() fails we jump into the resource
> cleanup path which contains a of_node_put() call. Another
> instance of this has already been called at that time
> resulting a double decrement of the refcount.
> 
> Fix this by calling of_node_put() only after we are sure
> that nothing has gone wrong.
> 
> Signed-off-by: Lucas Stach <l.stach@pengutronix.de>

-stable material?

> ---
>  drivers/cpufreq/cpufreq-dt.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/cpufreq/cpufreq-dt.c b/drivers/cpufreq/cpufreq-dt.c
> index e00265066a75..6bbb8b913446 100644
> --- a/drivers/cpufreq/cpufreq-dt.c
> +++ b/drivers/cpufreq/cpufreq-dt.c
> @@ -259,7 +259,6 @@ static int cpufreq_init(struct cpufreq_policy *policy)
>  		else
>  			priv->cdev = cdev;
>  	}
> -	of_node_put(np);
>  
>  	priv->cpu_dev = cpu_dev;
>  	priv->cpu_reg = cpu_reg;
> @@ -270,6 +269,8 @@ static int cpufreq_init(struct cpufreq_policy *policy)
>  	if (ret)
>  		goto out_cooling_unregister;
>  
> +	of_node_put(np);
> +
>  	return 0;
>  
>  out_cooling_unregister:
> 

-- 
I speak only for myself.
Rafael J. Wysocki, Intel Open Source Technology Center.

Re: [PATCH] cpufreq: dt: fix potential double put of cpu OF node

[Lucas Stach]

Am Samstag, den 27.09.2014, 00:14 +0200 schrieb Rafael J. Wysocki:
> On Friday, September 26, 2014 03:33:46 PM Lucas Stach wrote:
> > If cpufreq_generic_init() fails we jump into the resource
> > cleanup path which contains a of_node_put() call. Another
> > instance of this has already been called at that time
> > resulting a double decrement of the refcount.
> > 
> > Fix this by calling of_node_put() only after we are sure
> > that nothing has gone wrong.
> > 
> > Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
> 
> -stable material?
> 
The relevant code that exposed this bug was only merged in 3.17, so this
patch is only -stable if it goes in after 3.17 final.

> > ---
> >  drivers/cpufreq/cpufreq-dt.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/cpufreq/cpufreq-dt.c b/drivers/cpufreq/cpufreq-dt.c
> > index e00265066a75..6bbb8b913446 100644
> > --- a/drivers/cpufreq/cpufreq-dt.c
> > +++ b/drivers/cpufreq/cpufreq-dt.c
> > @@ -259,7 +259,6 @@ static int cpufreq_init(struct cpufreq_policy *policy)
> >  		else
> >  			priv->cdev = cdev;
> >  	}
> > -	of_node_put(np);
> >  
> >  	priv->cpu_dev = cpu_dev;
> >  	priv->cpu_reg = cpu_reg;
> > @@ -270,6 +269,8 @@ static int cpufreq_init(struct cpufreq_policy *policy)
> >  	if (ret)
> >  		goto out_cooling_unregister;
> >  
> > +	of_node_put(np);
> > +
> >  	return 0;
> >  
> >  out_cooling_unregister:
> > 
> 

-- 
Pengutronix e.K.             | Lucas Stach                 |
Industrial Linux Solutions   | http://www.pengutronix.de/  |