Re: [PATCH] irqchip/renesas-rzg2l: Fix missing put_device

Marc Zyngier
2024-09-30T19:14:55Z

On Mon, 30 Sep 2024 17:36:20 +0100,
Fabrizio Castro <fabrizio.castro.jz@renesas.com> wrote:
>
> Hi Marc,
>
> Thanks for your feedback.
>
> > From: Marc Zyngier <maz@kernel.org>
> > Sent: Monday, September 30, 2024 4:50 PM
> > To: Fabrizio Castro <fabrizio.castro.jz@renesas.com>
> > Subject: Re: [PATCH] irqchip/renesas-rzg2l: Fix missing put_device
> >
> > On Mon, 30 Sep 2024 15:55:39 +0100,
> > Fabrizio Castro <fabrizio.castro.jz@renesas.com> wrote:
> > >
> > > rzg2l_irqc_common_init calls of_find_device_by_node, but the
> > > corresponding put_device call is missing.
> > >
> > > Make sure we call put_device both when failing and when succeeding.
> >
> > What sort of lifetime are you trying to enforce?
>
> Function rzg2l_irqc_common_init uses pdev->dev until its very end.
> My understanding is that we should decrement the reference counter
> once we are fully done with it. Is my understanding correct?

"done with it" is what scares me. Specially when I see code like this:

rzg2l_irqc_data = devm_kzalloc(&pdev->dev, sizeof(*rzg2l_irqc_data), GFP_KERNEL);
if (!rzg2l_irqc_data)
return -ENOMEM;

rzg2l_irqc_data->irqchip = irq_chip;

rzg2l_irqc_data->base = devm_of_iomap(&pdev->dev, pdev->dev.of_node, 0, NULL);
if (IS_ERR(rzg2l_irqc_data->base))
return PTR_ERR(rzg2l_irqc_data->base);

If you drop the reference on the device, you are allowing it to be
removed, and everything the driver cares about to disappear behind its
back.

I can't really see how this is safe, because in general, removing an
interrupt controller driver from the system is a pretty bad idea, and
I'm worried that's you are implicitly enabling.