| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20251116081602.28926-1-make24@iscas.ac.cn>
Date: Sun, 16 Nov 2025 16:16:02 +0800
From: Ma Ke <make24@...as.ac.cn>
To: tglx@...utronix.de,
maz@...nel.org,
shawn.guo@...aro.org
Cc: linux-kernel@...r.kernel.org,
akpm@...ux-foundation.org,
Ma Ke <make24@...as.ac.cn>,
stable@...r.kernel.org
Subject: [PATCH] irqchip: Fix error handling in qcom_mpm_init
of_find_device_by_node() increments the reference count but it's never
decremented, preventing proper device cleanup. Add put_device()
properly to ensure references released before function return.
Found by code review.
Cc: stable@...r.kernel.org
Fixes: a6199bb514d8 ("irqchip: Add Qualcomm MPM controller driver")
Signed-off-by: Ma Ke <make24@...as.ac.cn>
---
drivers/irqchip/irq-qcom-mpm.c | 56 +++++++++++++++++++++++-----------
1 file changed, 38 insertions(+), 18 deletions(-)
diff --git a/drivers/irqchip/irq-qcom-mpm.c b/drivers/irqchip/irq-qcom-mpm.c
index 8d569f7c5a7a..8e5303375261 100644
--- a/drivers/irqchip/irq-qcom-mpm.c
+++ b/drivers/irqchip/irq-qcom-mpm.c
@@ -333,14 +333,19 @@ static int qcom_mpm_init(struct device_node *np, struct device_node *parent)
int i, irq;
int ret;
+ if (!pdev)
+ return -ENODEV;
+
priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
- if (!priv)
- return -ENOMEM;
+ if (!priv) {
+ ret = -ENOMEM;
+ goto err_put_device;
+ }
ret = of_property_read_u32(np, "qcom,mpm-pin-count", &pin_cnt);
if (ret) {
dev_err(dev, "failed to read qcom,mpm-pin-count: %d\n", ret);
- return ret;
+ goto err_put_device;
}
priv->reg_stride = DIV_ROUND_UP(pin_cnt, 32);
@@ -348,19 +353,22 @@ static int qcom_mpm_init(struct device_node *np, struct device_node *parent)
ret = of_property_count_u32_elems(np, "qcom,mpm-pin-map");
if (ret < 0) {
dev_err(dev, "failed to read qcom,mpm-pin-map: %d\n", ret);
- return ret;
+ goto err_put_device;
}
if (ret % 2) {
dev_err(dev, "invalid qcom,mpm-pin-map\n");
- return -EINVAL;
+ ret = -EINVAL;
+ goto err_put_device;
}
priv->map_cnt = ret / 2;
priv->maps = devm_kcalloc(dev, priv->map_cnt, sizeof(*priv->maps),
GFP_KERNEL);
- if (!priv->maps)
- return -ENOMEM;
+ if (!priv->maps) {
+ ret = -ENOMEM;
+ goto err_put_device;
+ }
for (i = 0; i < priv->map_cnt; i++) {
u32 pin, hwirq;
@@ -386,19 +394,23 @@ static int qcom_mpm_init(struct device_node *np, struct device_node *parent)
ret = of_address_to_resource(msgram_np, 0, &res);
if (ret) {
of_node_put(msgram_np);
- return ret;
+ goto err_put_device;
}
/* Don't use devm_ioremap_resource, as we're accessing a shared region. */
priv->base = devm_ioremap(dev, res.start, resource_size(&res));
of_node_put(msgram_np);
- if (!priv->base)
- return -ENOMEM;
+ if (!priv->base) {
+ ret = -ENOMEM;
+ goto err_put_device;
+ }
} else {
/* Otherwise, fall back to simple MMIO. */
priv->base = devm_platform_ioremap_resource(pdev, 0);
- if (IS_ERR(priv->base))
- return PTR_ERR(priv->base);
+ if (IS_ERR(priv->base)) {
+ ret = PTR_ERR(priv->base);
+ goto err_put_device;
+ }
}
for (i = 0; i < priv->reg_stride; i++) {
@@ -410,21 +422,25 @@ static int qcom_mpm_init(struct device_node *np, struct device_node *parent)
}
irq = platform_get_irq(pdev, 0);
- if (irq < 0)
- return irq;
+ if (irq < 0) {
+ ret = irq;
+ goto err_put_device;
+ }
genpd = &priv->genpd;
genpd->flags = GENPD_FLAG_IRQ_SAFE;
genpd->power_off = mpm_pd_power_off;
genpd->name = devm_kasprintf(dev, GFP_KERNEL, "%s", dev_name(dev));
- if (!genpd->name)
- return -ENOMEM;
+ if (!genpd->name) {
+ ret = -ENOMEM;
+ goto err_put_device;
+ }
ret = pm_genpd_init(genpd, NULL, false);
if (ret) {
dev_err(dev, "failed to init genpd: %d\n", ret);
- return ret;
+ goto err_put_device;
}
ret = of_genpd_add_provider_simple(np, genpd);
@@ -438,7 +454,7 @@ static int qcom_mpm_init(struct device_node *np, struct device_node *parent)
if (IS_ERR(priv->mbox_chan)) {
ret = PTR_ERR(priv->mbox_chan);
dev_err(dev, "failed to acquire IPC channel: %d\n", ret);
- return ret;
+ goto remove_genpd;
}
parent_domain = irq_find_host(parent);
@@ -466,6 +482,7 @@ static int qcom_mpm_init(struct device_node *np, struct device_node *parent)
goto remove_domain;
}
+ put_device(dev);
return 0;
remove_domain:
@@ -474,6 +491,9 @@ static int qcom_mpm_init(struct device_node *np, struct device_node *parent)
mbox_free_channel(priv->mbox_chan);
remove_genpd:
pm_genpd_remove(genpd);
+err_put_device:
+ if (pdev)
+ put_device(dev);
return ret;
}
--
2.17.1
Powered by blists - more mailing lists