linux-kernel - [PATCH v2] pmdomain: mtk-pm-domains: improve spinlock recursion fix in probe with correcting reference count

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20251128041722.3540037-1-macpaul.lin@mediatek.com>
Date: Fri, 28 Nov 2025 12:17:22 +0800
From: Macpaul Lin <macpaul.lin@...iatek.com>
To: Ulf Hansson <ulf.hansson@...aro.org>, Matthias Brugger
	<matthias.bgg@...il.com>, AngeloGioacchino Del Regno
	<angelogioacchino.delregno@...labora.com>,
	Nícolas F . R . A . Prado
	<nfraprado@...labora.com>, Macpaul Lin <macpaul.lin@...iatek.com>, "Chen-Yu
 Tsai" <wenst@...omium.org>, <linux-pm@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>, <linux-arm-kernel@...ts.infradead.org>,
	<linux-mediatek@...ts.infradead.org>
CC: Weiyi Lu <Weiyi.Lu@...iatek.com>, Jian Hui Lee
	<jianhui.lee@...onical.com>, Irving-CH Lin <Irving-CH.Lin@...iatek.com>,
	<conor@...nel.org>, <krzk@...nel.org>, Louis-Alexis Eyraud
	<louisalexis.eyraud@...labora.com>, Bear Wang <bear.wang@...iatek.com>,
	"Pablo Sun" <pablo.sun@...iatek.com>, Ramax Lo <ramax.lo@...iatek.com>,
	Macpaul Lin <macpaul@...il.com>, MediaTek Chromebook Upstream
	<Project_Global_Chrome_Upstream_Group@...iatek.com>, <Stable@...r.kernel.org>
Subject: [PATCH v2] pmdomain: mtk-pm-domains: improve spinlock recursion fix in probe with correcting reference count

Remove scpsys_get_legacy_regmap(), replacing its usage with
of_find_node_with_property().  Explicitly call of_node_get(np) before each
of_find_node_with_property() to maintain correct node reference counting.

The of_find_node_with_property() function "consumes" its input by calling
of_node_put() internally, whether or not it finds a match.
Currently, dev->of_node (np) is passed multiple times in sequence without
incrementing its reference count, causing it to be decremented multiple times
and risking early memory release.

Adding of_node_get(np) before each call balances the reference count,
preventing premature node release.

Fixes: c1bac49fe91f ("pmdomains: mtk-pm-domains: Fix spinlock recursion in probe")
Cc: Stable@...r.kernel.org
Signed-off-by: Macpaul Lin <macpaul.lin@...iatek.com>
Tested-by: Louis-Alexis Eyraud <louisalexis.eyraud@...labora.com>
---
 drivers/pmdomain/mediatek/mtk-pm-domains.c | 21 ++++++---------------
 1 file changed, 6 insertions(+), 15 deletions(-)

Changes for v2:
 - Rewording commit message.
 - Add Fixes: and Tested-by: tag, thanks.

diff --git a/drivers/pmdomain/mediatek/mtk-pm-domains.c b/drivers/pmdomain/mediatek/mtk-pm-domains.c
index 80561d27f2b2..f64f24d520dd 100644
--- a/drivers/pmdomain/mediatek/mtk-pm-domains.c
+++ b/drivers/pmdomain/mediatek/mtk-pm-domains.c
@@ -984,18 +984,6 @@ static void scpsys_domain_cleanup(struct scpsys *scpsys)
 	}
 }
 
-static struct device_node *scpsys_get_legacy_regmap(struct device_node *np, const char *pn)
-{
-	struct device_node *local_node;
-
-	for_each_child_of_node(np, local_node) {
-		if (of_property_present(local_node, pn))
-			return local_node;
-	}
-
-	return NULL;
-}
-
 static int scpsys_get_bus_protection_legacy(struct device *dev, struct scpsys *scpsys)
 {
 	const u8 bp_blocks[3] = {
@@ -1017,7 +1005,8 @@ static int scpsys_get_bus_protection_legacy(struct device *dev, struct scpsys *s
 	 * this makes it then possible to allocate the array of bus_prot
 	 * regmaps and convert all to the new style handling.
 	 */
-	node = scpsys_get_legacy_regmap(np, "mediatek,infracfg");
+	of_node_get(np);
+	node = of_find_node_with_property(np, "mediatek,infracfg");
 	if (node) {
 		regmap[0] = syscon_regmap_lookup_by_phandle(node, "mediatek,infracfg");
 		of_node_put(node);
@@ -1030,7 +1019,8 @@ static int scpsys_get_bus_protection_legacy(struct device *dev, struct scpsys *s
 		regmap[0] = NULL;
 	}
 
-	node = scpsys_get_legacy_regmap(np, "mediatek,smi");
+	of_node_get(np);
+	node = of_find_node_with_property(np, "mediatek,smi");
 	if (node) {
 		smi_np = of_parse_phandle(node, "mediatek,smi", 0);
 		of_node_put(node);
@@ -1048,7 +1038,8 @@ static int scpsys_get_bus_protection_legacy(struct device *dev, struct scpsys *s
 		regmap[1] = NULL;
 	}
 
-	node = scpsys_get_legacy_regmap(np, "mediatek,infracfg-nao");
+	of_node_get(np);
+	node = of_find_node_with_property(np, "mediatek,infracfg-nao");
 	if (node) {
 		regmap[2] = syscon_regmap_lookup_by_phandle(node, "mediatek,infracfg-nao");
 		num_regmaps++;
-- 
2.45.2