linux-kernel - Re: [PATCH] usb: musb: Fix missing of_node_put() in omap2430

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20220408015438.GA138@VICKYMQLIN-NB1.localdomain>
Date:   Fri, 8 Apr 2022 09:54:38 +0800
From:   Miaoqian Lin <linmq006@...il.com>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     Bin Liu <b-liu@...com>, Roger Quadros <rogerq@...com>,
        linux-usb@...r.kernel.org, linux-omap@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] usb: musb: Fix missing of_node_put() in omap2430_probe

On Wed, Mar 09, 2022 at 12:25:03PM +0100, Greg Kroah-Hartman wrote:
> On Wed, Mar 09, 2022 at 11:10:33AM +0000, Miaoqian Lin wrote:
> > The device_node pointer is returned by of_parse_phandle() with refcount
> > incremented. We should use of_node_put() on it when done.
> > 
> > Fixes: 8934d3e4d0e7 ("usb: musb: omap2430: Don't use omap_get_control_dev()")
> > Signed-off-by: Miaoqian Lin <linmq006@...il.com>
> > ---
> >  drivers/usb/musb/omap2430.c | 1 +
> >  1 file changed, 1 insertion(+)
> > 
> > diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
> > index 7d4d0713f4f0..4a963cfa385b 100644
> > --- a/drivers/usb/musb/omap2430.c
> > +++ b/drivers/usb/musb/omap2430.c
> > @@ -363,6 +363,7 @@ static int omap2430_probe(struct platform_device *pdev)
> >  	control_node = of_parse_phandle(np, "ctrl-module", 0);
> >  	if (control_node) {
> >  		control_pdev = of_find_device_by_node(control_node);
> > +		of_node_put(control_node);
> >  		if (!control_pdev) {
> >  			dev_err(&pdev->dev, "Failed to get control device\n");
> >  			ret = -EINVAL;
> > -- 
> > 2.17.1
> > 
> 
> How was this tested?

Hi, Greg Kroah-Hartman

    I mainly went through the specifications of of_parse_phandle() and
 of_find_device_by_node(), and checked their usages in the codebase
 to infer their correct usages then found out the deviant one, and
 manually confirmed it. 

    In doc of of_parse_phandle() it mentions : 
 > Return: The device_node pointer with refcount incremented.  Use 
 > * of_node_put() on it when done. 
    In the doc of  and of_find_device_by_node() it mentions:
 > * Takes a reference to the embedded struct device which needs to
 > be dropped
 > * after use.

    In this case, control_node is a local variable, and it never be used
 after of_find_device_by_node(), of_find_device_by_node() call will
 take its own reference. So the reference holded by control_node
 should be released.

    I checked the usages
 pattern——`$ret=of_parse_phandle();of_find_device_by_node($ret);` in
 codebase and most of them handle the reference after use.
 For example: 
 - function pwm_omap_dmtimer_probe in drivers/pwm/pwm-omap-dmtimer.c 
 - function mtk_smi_device_link_common in drivers/memory/mtk-smi.c, 
 - function devm_tegra_memory_controller_get in
      drivers/memory/tegra/mc.c.

    I also took similar bugfixes for reference, for exmaple:
 - commit c8d0ccfd73da ("media: mtk-vpu: fix leaked of_node references") 
 - commit 3d38faef0de1 ("ath11k: add missing of_node_put() to avoid leak") 
    
    So I sent patch for this one. Still not sure if it's correct,
    I hope the developers could double check this, Thanks.