linux-kernel - Re: [PATCH] thermal: thermal_of: Fix device node reference leak in thermal_of_cm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAJZ5v0h3YMqT9uH+aLxu7SKsqY12AN7R04fRrL8Q+Z4wo0JaOA@mail.gmail.com>
Date: Tue, 28 Oct 2025 13:03:34 +0100
From: "Rafael J. Wysocki" <rafael@...nel.org>
To: Miaoqian Lin <linmq006@...il.com>, Daniel Lezcano <daniel.lezcano@...aro.org>, 
	Lukasz Luba <lukasz.luba@....com>
Cc: "Rafael J. Wysocki" <rafael@...nel.org>, Zhang Rui <rui.zhang@...el.com>, linux-pm@...r.kernel.org, 
	linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH] thermal: thermal_of: Fix device node reference leak in thermal_of_cm_lookup

On Tue, Oct 28, 2025 at 7:08 AM Miaoqian Lin <linmq006@...il.com> wrote:
>
> In thermal_of_cm_lookup(), of_parse_phandle() returns a device node with
> its reference count incremented. The caller is responsible for releasing
> this reference when the node is no longer needed.
>
> Add of_node_put(tr_np) to fix the reference leaks.
>
> Found via static analysis.
>
> Fixes: 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree initialization")
> Cc: stable@...r.kernel.org
> Signed-off-by: Miaoqian Lin <linmq006@...il.com>
> ---
>  drivers/thermal/thermal_of.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/thermal/thermal_of.c b/drivers/thermal/thermal_of.c
> index 1a51a4d240ff..2bb1b8e471cf 100644
> --- a/drivers/thermal/thermal_of.c
> +++ b/drivers/thermal/thermal_of.c
> @@ -284,8 +284,11 @@ static bool thermal_of_cm_lookup(struct device_node *cm_np,
>                 int count, i;
>
>                 tr_np = of_parse_phandle(child, "trip", 0);
> -               if (tr_np != trip->priv)
> +               if (tr_np != trip->priv) {
> +                       of_node_put(tr_np);
>                         continue;
> +               }
> +               of_node_put(tr_np);

This will also work because tr_np is not dereferenced below:

                tr_np = of_parse_phandle(child, "trip", 0);
                of_node_put(tr_np);
                if (tr_np != trip->priv)
                                continue;

but a more general question is whether or not device nodes used for
populating thermal zone trip points can be let go.

If not, then this change needs to be combined with another one that
will prevent them from going away.

Presumably they need to be reference counted in
thermal_of_populate_trip().  Daniel?

>
>                 /* The trip has been found, look up the cdev. */
>                 count = of_count_phandle_with_args(child, "cooling-device",
> --