From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3C60BF9D9 for ; Mon, 11 May 2026 04:19:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778473177; cv=none; b=g9rSSYTMxi447XBCCiMVKeEYy3Ra2BzBQyH5p9ZDswAZQkSKQ26+nN7O9Yymxr+0ekkTpK6y5YUjDTZtnnaCGiTQhID7NifistpazCEzZXTatfDyE0PQHjkp+Mv6VWbDqfc2umYon1aOxcXgNlOXEWpjT/RqeQVErKdelTndX+c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778473177; c=relaxed/simple; bh=UKL3/6ObZbN73UvV3SxxvUoj1Xc5oqXCLkUcUgzWubc=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=gixQuc2vBZEfFRsn1kEahQwcu703xf8I9hf0AscWKU/iimHi2FrXMAb0r+pfHI8T5FwE3u2J3OcXBKGJ7RGvohHrnvv1Joqre1osByh65je4C5gYQWUQZebohrGag85ZCJOpbkIFk7wuI52H06hZp/9lBbIQBFIoVAug+NWGU9o= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=D94GvMLM; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=MjN+ADm4; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="D94GvMLM"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="MjN+ADm4" Received: from pps.filterd (m0279872.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 64B4GoA8652833 for ; Mon, 11 May 2026 04:19:35 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:message-id :mime-version:subject:to; s=qcppdkim1; bh=QTFp0bZDGTPide3dBX8di6 1N7r64en4XU6M+Ji4UmZE=; b=D94GvMLM36ZUBcoiauVKk9xBLDaiBJfYumdkiE hbl/Is5tKkAqf3qa4uyGExLy0btgflwQL94tHNqU1YYivbmvqw2hUzvEgERSAMDa XMQRpapB+zpkPbsNMot21EUj7rsRieJM21wrd1dlENml1zc9g2NfjFQhUp9RdwuT Dzal3EN2m4SMbsASsQK1chmF7HNRJboAu2uUYOURXXu5SO9Y2JIkdxUj6VMpr9re YMaUqUNw68rVc4bKf8LKqqr+1IiRwQm3UQUVo/Cm3oMoZm4Gn0W29zi4RqrdJ0nG AlPx2C1afNMCL+hOnbY3ACfhayhoJvaEq6zf0sbqIMaAhdhQ== Received: from mail-pf1-f199.google.com (mail-pf1-f199.google.com [209.85.210.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4e37xu806f-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Mon, 11 May 2026 04:19:34 +0000 (GMT) Received: by mail-pf1-f199.google.com with SMTP id d2e1a72fcca58-8353b042152so3948128b3a.3 for ; Sun, 10 May 2026 21:19:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1778473174; x=1779077974; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:from:to:cc:subject:date:message-id:reply-to; bh=QTFp0bZDGTPide3dBX8di61N7r64en4XU6M+Ji4UmZE=; b=MjN+ADm4mdPGoQMBaul7M3ZZ7Uf55rFkHwLBqQc8dcsO5RliwgbWTw+9B2hC9ishtF FlwPSojCEWBNrQoZPunci4scSgtxGs1bz+AkXpA+87R935ZGcnhHz8igZ4vQaeqjTcDX 1OO1Ot0aQFXvtno4zoSTeUHW/E54d5u5XQMv4cv+q/i6o9hF1tJ9ZqLliQxMN5Sb7efq /I86kKJag44uSeFqCdBGMW8nD2MJB5zbXU+qbwnD/xmgFkDeDMIbhbS/YAt0siKelkv6 OIDJdwlu93DxoBIZuWXpbrJ7VwOj4+lhKbmnpXcZLzBHqbC6t2mZteCvcMKV4LZ+Aopd 0O3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778473174; x=1779077974; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=QTFp0bZDGTPide3dBX8di61N7r64en4XU6M+Ji4UmZE=; b=G3z0wUtK0s/bKk5dFvDwDlqJ5JM8fH4Ek5NG+TQW5AWx4mwmPscGf/P+R9H5mwqFc4 XUrxIs7Y4WxrA4HeqiPARHKDAT72ONVZ7WvTnCEBHbxJPnbCSpU1aQiJx6kFK/LihvQX jCOcapiV8ktT3hIkGKbpaQf2l4QxcalSAjRcP/SsjK5B+uoV3bbc1OhxMgB1IyMlqdSE mT/zx9L4EpKDx4waZNQweFF3XV31DYxaY3BG+GYqwDX1asxlXJ7ZMIr74RhI4BGqilsA wpRbF6xmAoYAUFL9BD/tMGXLKhHQnRvBO/Eb7bxnrb+Xmw4PnzHVxTvsgDqnT8tnPdxm TmMQ== X-Forwarded-Encrypted: i=1; AFNElJ+No5zzUK5LhbdgUkowj6OLNZDyRUEXJLwYib7wPEDt4DR1VuAD3EAfRT/u0Zx1aZL3iDgxdITJ35lYaG4=@vger.kernel.org X-Gm-Message-State: AOJu0YwclRVLERPJMC7bE1i8FtuigY8+y/V8U9QfPgWbhFSWMhOVDted 3cwNPes7RIWDqg4oBDJfburLCWEFJj1UTIE1LtUpPEZrnzRGDKzc8ideczcT/4d20sAbQqAeeRl kdvNDc4I7+kjl1U8y180v+07sDWNXXqfHvMAsxB+xPmbXE7oD8OfH/dRzhNyBZ+a5ok8= X-Gm-Gg: Acq92OGiMZJ06HYHye+O1MNBQLKgP2/Bx7WzeFfZovMBEPS/M/p+wWv2IxGavXPxZgV ZFeCghKaFgRaPrldMlUBw2LUJvNNn3As61/9J1sugLOdqiWF2T8ntkKyp+2RuyuwcMOFAZ23RYS qaS7klihSGOi3Wzp/bXKAL6fHoVDnxUP+8RGFfb9f0NSBJcSWyxuKoIOtmQlMpkT33b/MZvjwOt UxQ/YYzsf9d3FwmJeGP+WdtOXDLibrZ9cQGj41k/0y7ZJnH9konf6ah4y0sCdzWkMqHhQqiatwX 9T9Zq6UvGGuixl2EB1n/pUvvQH/g1vCOQPSu2qK+VTK0x63TQaab1umyNgM7Ea9kJ9y9mv23mbM x22gY003pTimSXPFvezv6GBktYrV8I3QL6SFv0ptY/dBslgk8OO9+DQF7A2+w/EbRVU/MTvTspi OdRbzOfjfi X-Received: by 2002:a05:6a00:14c3:b0:83e:b443:9651 with SMTP id d2e1a72fcca58-83eb4439a28mr4972125b3a.4.1778473173970; Sun, 10 May 2026 21:19:33 -0700 (PDT) X-Received: by 2002:a05:6a00:14c3:b0:83e:b443:9651 with SMTP id d2e1a72fcca58-83eb4439a28mr4972089b3a.4.1778473173447; Sun, 10 May 2026 21:19:33 -0700 (PDT) Received: from jiegan-gv.ap.qualcomm.com (tpe-colo-wan-fw-bordernet.qualcomm.com. [103.229.16.4]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-8396563f049sm21441399b3a.7.2026.05.10.21.19.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 10 May 2026 21:19:33 -0700 (PDT) From: Jie Gan Date: Mon, 11 May 2026 12:19:18 +0800 Subject: [PATCH] coresight: platform: defer connection counter increment until alloc succeeds Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260511-fix-ref-count-issue-v1-1-99d647810d3c@oss.qualcomm.com> X-B4-Tracking: v=1; b=H4sIAMZYAWoC/x2MywqAIBAAfyX23IL2kvqV6BC21l403ApB+vek4 8DMZBCKTAJTlSHSw8LBF9B1BfZY/U7IW2FoVDOoXmt0nDCSQxtufyGL3ITGdp2ldjRKOSjlWQR O/3Ve3vcDTva7NWUAAAA= To: Suzuki K Poulose , Mike Leach , James Clark , Leo Yan , Alexander Shishkin , Tingwei Zhang Cc: coresight@lists.linaro.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Jie Gan X-Mailer: b4 0.14.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1778473170; l=2818; i=jie.gan@oss.qualcomm.com; s=20250909; h=from:subject:message-id; bh=UKL3/6ObZbN73UvV3SxxvUoj1Xc5oqXCLkUcUgzWubc=; b=limRhpFZvkKg6PHRA5Ay5YOt4fAhWKPitzgNAc7/aCJu5IWBfOdqmXHxHbpNw3IZO2+/cW6Sw wUd+S+WAqUjAfiMMwwK3OWltbuG9N+hpS9zEC287BYg/KatNERNXm6H X-Developer-Key: i=jie.gan@oss.qualcomm.com; a=ed25519; pk=3LxxUZRPCNkvPDlWOvXfJNqNO4SfGdy3eghMb8puHuk= X-Authority-Analysis: v=2.4 cv=EcL4hvmC c=1 sm=1 tr=0 ts=6a0158d7 cx=c_pps a=WW5sKcV1LcKqjgzy2JUPuA==:117 a=nuhDOHQX5FNHPW3J6Bj6AA==:17 a=IkcTkHD0fZMA:10 a=NGcC8JguVDcA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=yx91gb_oNiZeI1HMLzn7:22 a=EUspDBNiAAAA:8 a=aWudVU2R90OKWqy0w6IA:9 a=QEXdDO2ut3YA:10 a=OpyuDcXvxspvyRM73sMx:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNTExMDA0NCBTYWx0ZWRfX8rF7ZdbsXEtj BiFynSmJlehr6W5S2QOfNU0Px++5xWa5On9NHC9w6KEthwcuiRYEM+sHLp5PWsQkQXR7uN8Nl3K DbbX/mjHKSbTnmJvFOHMCjVlOIgETzx5n7pT0CC2z1SVGTiAVRLR1MhnQRErnro7LfBJ/avU1BC Xd+WQ0LQ18qFQ/nbYAE0nn9Zg9f52KHcxpSUzj5c3lu7DoOFxJjr3kqnDz4yyA/aFqvNbRM9OzQ dylYojB22QQ3PhHq9ebzpWDrPp8Qaz4wgSUpwq2BOqbw4pOu2JqIrsDfJDfd1veZtgw4DzME9OV MNJhZE64ny/grYKNb3o2fu2gEYdGE7BPgyLPcLWAUFcnaHLA1C0EKbScrPFT3ABjX7AT+3BT9pd fC71qdyBUyPtUSczGczYfTRBhbVW9iAD1JPlozVCwZGdnoYGcF+Wu03WTsDZenQ/qOvt9gOpd6e l4j1b8tdej+YESbwBjQ== X-Proofpoint-ORIG-GUID: K5LnPSF6RoEAmjVxsi6YyC8302JxdmVo X-Proofpoint-GUID: K5LnPSF6RoEAmjVxsi6YyC8302JxdmVo X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-05-11_01,2026-05-08_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 bulkscore=0 adultscore=0 spamscore=0 impostorscore=0 lowpriorityscore=0 clxscore=1015 malwarescore=0 phishscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2604200000 definitions=main-2605110044 coresight_add_out_conn() increments nr_outconns before calling devm_krealloc_array() and again before devm_kmalloc(). If either allocation fails, the counter is already bumped while the corresponding array entry is NULL or uninitialized garbage. coresight_add_in_conn() has the same problem with nr_inconns and devm_krealloc_array(). In both cases the probe returns -ENOMEM, which causes coresight_get_platform_data() to call coresight_release_platform_data() for cleanup. That function iterates up to nr_outconns (or nr_inconns) entries and dereferences each pointer unconditionally, hitting the NULL or garbage entry and panicking instead of failing gracefully. Fix by moving the counter increments to after all allocations succeed, so the struct is always consistent on any error path. Fixes: 3d4ff657e454 ("coresight: Dynamically add connections") Fixes: e3f4e68797a9 ("coresight: Store in-connections as well as out-connections") Signed-off-by: Jie Gan --- drivers/hwtracing/coresight/coresight-platform.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/hwtracing/coresight/coresight-platform.c b/drivers/hwtracing/coresight/coresight-platform.c index e337b6e2bf32..93c2d075cad6 100644 --- a/drivers/hwtracing/coresight/coresight-platform.c +++ b/drivers/hwtracing/coresight/coresight-platform.c @@ -45,9 +45,8 @@ coresight_add_out_conn(struct device *dev, } } - pdata->nr_outconns++; pdata->out_conns = - devm_krealloc_array(dev, pdata->out_conns, pdata->nr_outconns, + devm_krealloc_array(dev, pdata->out_conns, pdata->nr_outconns + 1, sizeof(*pdata->out_conns), GFP_KERNEL); if (!pdata->out_conns) return ERR_PTR(-ENOMEM); @@ -63,7 +62,8 @@ coresight_add_out_conn(struct device *dev, * used right away. */ *conn = *new_conn; - pdata->out_conns[pdata->nr_outconns - 1] = conn; + pdata->out_conns[pdata->nr_outconns] = conn; + pdata->nr_outconns++; return conn; } EXPORT_SYMBOL_GPL(coresight_add_out_conn); @@ -86,13 +86,13 @@ int coresight_add_in_conn(struct coresight_connection *out_conn) return 0; } - pdata->nr_inconns++; pdata->in_conns = - devm_krealloc_array(dev, pdata->in_conns, pdata->nr_inconns, + devm_krealloc_array(dev, pdata->in_conns, pdata->nr_inconns + 1, sizeof(*pdata->in_conns), GFP_KERNEL); if (!pdata->in_conns) return -ENOMEM; - pdata->in_conns[pdata->nr_inconns - 1] = out_conn; + pdata->in_conns[pdata->nr_inconns] = out_conn; + pdata->nr_inconns++; return 0; } EXPORT_SYMBOL_GPL(coresight_add_in_conn); --- base-commit: e98d21c170b01ddef366f023bbfcf6b31509fa83 change-id: 20260511-fix-ref-count-issue-7c44ce39700f Best regards, -- Jie Gan