[RESEND PATCH] mux: core: fix double get_device()

[RESEND PATCH] mux: core: fix double get_device()

[Peter Rosin]

From: Hans de Goede <hdegoede@redhat.com>

class_find_device already does a get_device on the returned device.
So the device returned by of_find_mux_chip_by_node is already referenced
and we should not reference it again (and unref it on error).

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Peter Rosin <peda@axentia.se>
---
 drivers/mux/core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Hi Greg,

Perhaps this was ignored due to more important stuff?

Original message below:

Here is a fix for 4.15, and it should perhaps also go to
stable?

It's been in -next for a couple of weeks w/o complaints.

Cheers,
Peter

diff --git a/drivers/mux/core.c b/drivers/mux/core.c
index 2260063b0ea8..6e5cf9d9cd99 100644
--- a/drivers/mux/core.c
+++ b/drivers/mux/core.c
@@ -413,6 +413,7 @@ static int of_dev_node_match(struct device *dev, const void *data)
 	return dev->of_node == data;
 }
 
+/* Note this function returns a reference to the mux_chip dev. */
 static struct mux_chip *of_find_mux_chip_by_node(struct device_node *np)
 {
 	struct device *dev;
@@ -466,6 +467,7 @@ struct mux_control *mux_control_get(struct device *dev, const char *mux_name)
 	    (!args.args_count && (mux_chip->controllers > 1))) {
 		dev_err(dev, "%pOF: wrong #mux-control-cells for %pOF\n",
 			np, args.np);
+		put_device(&mux_chip->dev);
 		return ERR_PTR(-EINVAL);
 	}
 
@@ -476,10 +478,10 @@ struct mux_control *mux_control_get(struct device *dev, const char *mux_name)
 	if (controller >= mux_chip->controllers) {
 		dev_err(dev, "%pOF: bad mux controller %u specified in %pOF\n",
 			np, controller, args.np);
+		put_device(&mux_chip->dev);
 		return ERR_PTR(-EINVAL);
 	}
 
-	get_device(&mux_chip->dev);
 	return &mux_chip->mux[controller];
 }
 EXPORT_SYMBOL_GPL(mux_control_get);
-- 
2.11.0

Re: [RESEND PATCH] mux: core: fix double get_device()

[Greg Kroah-Hartman]

On Mon, Jan 08, 2018 at 07:19:52PM +0100, Peter Rosin wrote:
> From: Hans de Goede <hdegoede@redhat.com>
> 
> class_find_device already does a get_device on the returned device.
> So the device returned by of_find_mux_chip_by_node is already referenced
> and we should not reference it again (and unref it on error).
> 
> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
> Signed-off-by: Peter Rosin <peda@axentia.se>
> ---
>  drivers/mux/core.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> Hi Greg,
> 
> Perhaps this was ignored due to more important stuff?

Yeah, the past few weeks have been a "bit" busy :(

I'll work to queue this up this week, sorry for the delay...

thanks,

greg k-h