From: Russell King <rmk+kernel@arm.linux.org.uk>
To: Florian Fainelli <f.fainelli@gmail.com>,
David Miller <davem@davemloft.net>
Cc: devicetree@vger.kernel.org, Frank Rowand <frowand.list@gmail.com>,
Grant Likely <grant.likely@linaro.org>,
Iyappan Subramanian <isubramanian@apm.com>,
Keyur Chudgar <kchudgar@apm.com>,
linux-arm-kernel@lists.infradead.org,
linuxppc-dev@lists.ozlabs.org, Li Yang <leoli@freescale.com>,
Michal Simek <michal.simek@xilinx.com>,
netdev@vger.kernel.org, Robert Richter <rric@kernel.org>,
Rob Herring <robh+dt@kernel.org>,
"Soren Brinkmann" <soren.brinkmann@xilinx.com>,
Sunil Goutham <sgoutham@cavium.com>,
Thomas Petazzoni <thomas.petazzoni@free-electrons.com>,
linux-kernel@vger.kernel.org
Subject: [PATCH 1/9] phy: fix of_mdio_find_bus() device refcount leak
Date: Tue, 22 Sep 2015 17:18:02 +0100 [thread overview]
Message-ID: <E1ZeQGY-0006UR-Mo@rmk-PC.arm.linux.org.uk> (raw)
In-Reply-To: <20150922161710.GA21084@n2100.arm.linux.org.uk>
of_mdio_find_bus() leaks a struct device refcount, caused by using
class_find_device() and not realising that the device reference has
its refcount incremented:
* Note, you will need to drop the reference with put_device() after use.
...
while ((dev = class_dev_iter_next(&iter))) {
if (match(dev, data)) {
get_device(dev);
break;
}
Update the comment, and arrange for the phy code to drop this refcount
when disposing of a reference to it.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
---
drivers/net/phy/mdio-mux.c | 19 +++++++++++++------
drivers/net/phy/mdio_bus.c | 4 +++-
2 files changed, 16 insertions(+), 7 deletions(-)
diff --git a/drivers/net/phy/mdio-mux.c b/drivers/net/phy/mdio-mux.c
index 4d4d25efc1e1..280c7c311f72 100644
--- a/drivers/net/phy/mdio-mux.c
+++ b/drivers/net/phy/mdio-mux.c
@@ -113,18 +113,18 @@ int mdio_mux_init(struct device *dev,
if (!parent_bus_node)
return -ENODEV;
- parent_bus = of_mdio_find_bus(parent_bus_node);
- if (parent_bus == NULL) {
- ret_val = -EPROBE_DEFER;
- goto err_parent_bus;
- }
-
pb = devm_kzalloc(dev, sizeof(*pb), GFP_KERNEL);
if (pb == NULL) {
ret_val = -ENOMEM;
goto err_parent_bus;
}
+ parent_bus = of_mdio_find_bus(parent_bus_node);
+ if (parent_bus == NULL) {
+ ret_val = -EPROBE_DEFER;
+ goto err_parent_bus;
+ }
+
pb->switch_data = data;
pb->switch_fn = switch_fn;
pb->current_child = -1;
@@ -173,6 +173,10 @@ int mdio_mux_init(struct device *dev,
dev_info(dev, "Version " DRV_VERSION "\n");
return 0;
}
+
+ /* balance the reference of_mdio_find_bus() took */
+ put_device(&pb->mii_bus->dev);
+
err_parent_bus:
of_node_put(parent_bus_node);
return ret_val;
@@ -189,6 +193,9 @@ void mdio_mux_uninit(void *mux_handle)
mdiobus_free(cb->mii_bus);
cb = cb->next;
}
+
+ /* balance the reference of_mdio_find_bus() in mdio_mux_init() took */
+ put_device(&pb->mii_bus->dev);
}
EXPORT_SYMBOL_GPL(mdio_mux_uninit);
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 02a4615b65f8..67553e13bd36 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -167,7 +167,9 @@ static int of_mdio_bus_match(struct device *dev, const void *mdio_bus_np)
* of_mdio_find_bus - Given an mii_bus node, find the mii_bus.
* @mdio_bus_np: Pointer to the mii_bus.
*
- * Returns a pointer to the mii_bus, or NULL if none found.
+ * Returns a reference to the mii_bus, or NULL if none found. The
+ * embedded struct device will have its reference count incremented,
+ * and this must be put once the bus is finished with.
*
* Because the association of a device_node and mii_bus is made via
* of_mdiobus_register(), the mii_bus cannot be found before it is
--
2.1.0
next prev parent reply other threads:[~2015-09-22 16:18 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-09-22 16:17 [PATCH v2 0/9] Phy, mdiobus, and netdev struct device fixes Russell King - ARM Linux
2015-09-22 16:18 ` Russell King [this message]
2015-09-22 16:18 ` [PATCH 2/9] net: dsa: fix of_mdio_find_bus() device refcount leak Russell King
2015-09-22 16:18 ` [PATCH 3/9] phy: fix mdiobus module safety Russell King
2015-09-22 16:18 ` [PATCH 4/9] phy: add proper phy struct device refcounting Russell King
2015-09-22 16:18 ` [PATCH 5/9] of_mdio: fix MDIO phy " Russell King
2015-09-22 16:18 ` [PATCH 6/9] net: fix phy refcounting in a bunch of drivers Russell King
2015-09-22 16:18 ` [PATCH 7/9] phy: fixed-phy: properly validate phy in fixed_phy_update_state() Russell King
2015-09-22 16:18 ` [PATCH 8/9] phy: add phy_device_remove() Russell King
2015-09-22 16:18 ` [PATCH 9/9] net: fix net_device refcounting Russell King
2015-09-23 23:24 ` [PATCH v2 0/9] Phy, mdiobus, and netdev struct device fixes David Miller
2015-09-24 16:00 ` Russell King - ARM Linux
2015-09-24 19:35 ` [PATCH RESEND v3 1/9] phy: fix of_mdio_find_bus() device refcount leak Russell King
2015-09-24 19:35 ` [PATCH RESEND v3 2/9] net: dsa: " Russell King
2015-09-24 19:36 ` [PATCH RESEND v3 3/9] phy: fix mdiobus module safety Russell King
2015-09-24 19:36 ` [PATCH RESEND v3 4/9] phy: add proper phy struct device refcounting Russell King
2015-09-24 19:36 ` [PATCH RESEND v3 5/9] of_mdio: fix MDIO phy " Russell King
2015-09-24 22:21 ` Rob Herring
2015-09-24 19:36 ` [PATCH RESEND v3 6/9] net: fix phy refcounting in a bunch of drivers Russell King
2015-09-24 19:36 ` [PATCH RESEND v3 7/9] phy: fixed-phy: properly validate phy in fixed_phy_update_state() Russell King
2015-09-24 19:36 ` [PATCH RESEND v3 8/9] phy: add phy_device_remove() Russell King
2015-09-24 19:36 ` [PATCH RESEND v3 9/9] net: fix net_device refcounting Russell King
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=E1ZeQGY-0006UR-Mo@rmk-PC.arm.linux.org.uk \
--to=rmk+kernel@arm.linux.org.uk \
--cc=davem@davemloft.net \
--cc=devicetree@vger.kernel.org \
--cc=f.fainelli@gmail.com \
--cc=frowand.list@gmail.com \
--cc=grant.likely@linaro.org \
--cc=isubramanian@apm.com \
--cc=kchudgar@apm.com \
--cc=leoli@freescale.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=michal.simek@xilinx.com \
--cc=netdev@vger.kernel.org \
--cc=robh+dt@kernel.org \
--cc=rric@kernel.org \
--cc=sgoutham@cavium.com \
--cc=soren.brinkmann@xilinx.com \
--cc=thomas.petazzoni@free-electrons.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).