linux-kernel - [PATCH] iommu/omap: Fix error handling in omap_iommu_probe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20251117033943.40749-1-make24@iscas.ac.cn>
Date: Mon, 17 Nov 2025 11:39:43 +0800
From: Ma Ke <make24@...as.ac.cn>
To: joro@...tes.org,
	will@...nel.org,
	robin.murphy@....com,
	t-kristo@...com,
	s-anna@...com
Cc: iommu@...ts.linux.dev,
	linux-kernel@...r.kernel.org,
	akpm@...ux-foundation.org,
	Ma Ke <make24@...as.ac.cn>,
	stable@...r.kernel.org
Subject: [PATCH] iommu/omap: Fix error handling in omap_iommu_probe_device

omap_iommu_probe_device() calls of_find_device_by_node() which
increments the reference count of the platform device, but fails to
decrement the reference count in both success and error paths. This
could lead to resource leakage and prevent proper device cleanup when
the IOMMU is unbound or the device is removed.

Found by code review.

Cc: stable@...r.kernel.org
Fixes: 9d5018deec86 ("iommu/omap: Add support to program multiple iommus")
Signed-off-by: Ma Ke <make24@...as.ac.cn>
---
 drivers/iommu/omap-iommu.c | 32 +++++++++++++++++++++-----------
 1 file changed, 21 insertions(+), 11 deletions(-)

diff --git a/drivers/iommu/omap-iommu.c b/drivers/iommu/omap-iommu.c
index 5c6f5943f44b..4df06cb09623 100644
--- a/drivers/iommu/omap-iommu.c
+++ b/drivers/iommu/omap-iommu.c
@@ -1637,6 +1637,7 @@ static struct iommu_device *omap_iommu_probe_device(struct device *dev)
 	struct omap_iommu *oiommu;
 	struct device_node *np;
 	int num_iommus, i;
+	int ret = 0;
 
 	/*
 	 * Allocate the per-device iommu structure for DT-based devices.
@@ -1663,28 +1664,26 @@ static struct iommu_device *omap_iommu_probe_device(struct device *dev)
 	for (i = 0, tmp = arch_data; i < num_iommus; i++, tmp++) {
 		np = of_parse_phandle(dev->of_node, "iommus", i);
 		if (!np) {
-			kfree(arch_data);
-			return ERR_PTR(-EINVAL);
+			ret = -EINVAL;
+			goto err_cleanup;
 		}
 
 		pdev = of_find_device_by_node(np);
+		of_node_put(np);
 		if (!pdev) {
-			of_node_put(np);
-			kfree(arch_data);
-			return ERR_PTR(-ENODEV);
+			ret = -ENODEV;
+			goto err_cleanup;
 		}
 
 		oiommu = platform_get_drvdata(pdev);
 		if (!oiommu) {
-			of_node_put(np);
-			kfree(arch_data);
-			return ERR_PTR(-EINVAL);
+			put_device(&pdev->dev);
+			ret = -EINVAL;
+			goto err_cleanup;
 		}
 
 		tmp->iommu_dev = oiommu;
 		tmp->dev = &pdev->dev;
-
-		of_node_put(np);
 	}
 
 	dev_iommu_priv_set(dev, arch_data);
@@ -1697,17 +1696,28 @@ static struct iommu_device *omap_iommu_probe_device(struct device *dev)
 	oiommu = arch_data->iommu_dev;
 
 	return &oiommu->iommu;
+
+err_cleanup:
+	for (tmp = arch_data; tmp < arch_data + i; tmp++) {
+		if (tmp->dev)
+			put_device(tmp->dev);
+	}
+	kfree(arch_data);
+	return ERR_PTR(ret);
 }
 
 static void omap_iommu_release_device(struct device *dev)
 {
 	struct omap_iommu_arch_data *arch_data = dev_iommu_priv_get(dev);
+	struct omap_iommu_arch_data *tmp;
 
 	if (!dev->of_node || !arch_data)
 		return;
 
-	kfree(arch_data);
+	for (tmp = arch_data; tmp->dev; tmp++)
+		put_device(tmp->dev);
 
+	kfree(arch_data);
 }
 
 static int omap_iommu_of_xlate(struct device *dev, const struct of_phandle_args *args)
-- 
2.17.1