kernel-janitors.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 0/4] add missing of_node_put
@ 2015-10-22  9:02 Julia Lawall
  2015-10-22  9:02 ` [PATCH 1/4] of/overlay: " Julia Lawall
                   ` (6 more replies)
  0 siblings, 7 replies; 23+ messages in thread
From: Julia Lawall @ 2015-10-22  9:02 UTC (permalink / raw)
  To: Rob Herring
  Cc: kernel-janitors, Frank Rowand, Grant Likely, devicetree, linux-kernel

The various for_each device_node iterators performs an of_node_get on each
iteration, so a break out of the loop requires an of_node_put.

The complete semantic patch that fixes this problem is
(http://coccinelle.lip6.fr):

// <smpl>
@r@
local idexpression n;
expression e1,e2;
iterator name for_each_node_by_name, for_each_node_by_type,
for_each_compatible_node, for_each_matching_node,
for_each_matching_node_and_match, for_each_child_of_node,
for_each_available_child_of_node, for_each_node_with_property;
iterator i;
statement S;
expression list [n1] es;
@@

(
(
for_each_node_by_name(n,e1) S
|
for_each_node_by_type(n,e1) S
|
for_each_compatible_node(n,e1,e2) S
|
for_each_matching_node(n,e1) S
|
for_each_matching_node_and_match(n,e1,e2) S
|
for_each_child_of_node(e1,n) S
|
for_each_available_child_of_node(e1,n) S
|
for_each_node_with_property(n,e1) S
)
&
i(es,n,...) S
)

@@
local idexpression r.n;
iterator r.i;
expression e;
expression list [r.n1] es;
@@

 i(es,n,...) {
   ...
(
   of_node_put(n);
|
   e = n
|
   return n;
|
+  of_node_put(n);
?  return ...;
)
   ...
 }

@@
local idexpression r.n;
iterator r.i;
expression e;
expression list [r.n1] es;
@@

 i(es,n,...) {
   ...
(
   of_node_put(n);
|
   e = n
|
+  of_node_put(n);
?  break;
)
   ...
 }
... when != n

@@
local idexpression r.n;
iterator r.i;
expression e;
identifier l;
expression list [r.n1] es;
@@

 i(es,n,...) {
   ...
(
   of_node_put(n);
|
   e = n
|
+  of_node_put(n);
?  goto l;
)
   ...
 }
...
l: ... when != n// </smpl>

---

 drivers/of/irq.c      |    7 +++++--
 drivers/of/overlay.c  |    5 ++++-
 drivers/of/platform.c |    8 ++++++--
 drivers/of/unittest.c |    8 ++++++--
 4 files changed, 21 insertions(+), 7 deletions(-)

^ permalink raw reply	[flat|nested] 23+ messages in thread

* [PATCH 1/4] of/overlay: add missing of_node_put
  2015-10-22  9:02 [PATCH 0/4] add missing of_node_put Julia Lawall
@ 2015-10-22  9:02 ` Julia Lawall
  2015-10-22  9:02 ` [PATCH 2/4] of/platform: " Julia Lawall
                   ` (5 subsequent siblings)
  6 siblings, 0 replies; 23+ messages in thread
From: Julia Lawall @ 2015-10-22  9:02 UTC (permalink / raw)
  To: Pantelis Antoniou
  Cc: kernel-janitors, Rob Herring, Frank Rowand, Grant Likely,
	devicetree, linux-kernel

for_each_child_of_node performs an of_node_get on each iteration, so
a break out of the loop requires an of_node_put.

A simplified version of the semantic patch that fixes this problem is as
follows (http://coccinelle.lip6.fr):

// <smpl>
@@
expression root,e;
local idexpression child;
@@

 for_each_child_of_node(root, child) {
   ... when != of_node_put(child)
       when != e = child
(
   return child;
|
+  of_node_put(child);
?  return ...;
)
   ...
 }
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>

---
 drivers/of/overlay.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
index 24e025f..54e5af9 100644
--- a/drivers/of/overlay.c
+++ b/drivers/of/overlay.c
@@ -149,6 +149,7 @@ static int of_overlay_apply_one(struct of_overlay *ov,
 			pr_err("%s: Failed to apply single node @%s/%s\n",
 					__func__, target->full_name,
 					child->name);
+			of_node_put(child);
 			return ret;
 		}
 	}
@@ -417,8 +418,10 @@ static int overlay_subtree_check(struct device_node *tree,
 		return 1;
 
 	for_each_child_of_node(tree, child) {
-		if (overlay_subtree_check(child, dn))
+		if (overlay_subtree_check(child, dn)) {
+			of_node_put(child);
 			return 1;
+		}
 	}
 
 	return 0;


^ permalink raw reply related	[flat|nested] 23+ messages in thread

* [PATCH 2/4] of/platform: add missing of_node_put
  2015-10-22  9:02 [PATCH 0/4] add missing of_node_put Julia Lawall
  2015-10-22  9:02 ` [PATCH 1/4] of/overlay: " Julia Lawall
@ 2015-10-22  9:02 ` Julia Lawall
       [not found] ` <1445504571-19838-1-git-send-email-Julia.Lawall-L2FTfq7BK8M@public.gmane.org>
                   ` (4 subsequent siblings)
  6 siblings, 0 replies; 23+ messages in thread
From: Julia Lawall @ 2015-10-22  9:02 UTC (permalink / raw)
  To: Rob Herring
  Cc: kernel-janitors, Frank Rowand, Grant Likely, devicetree, linux-kernel

for_each_child_of_node performs an of_node_get on each iteration, so
a break out of the loop requires an of_node_put.

A simplified version of the semantic patch that fixes this problem is as
follows (http://coccinelle.lip6.fr):

// <smpl>
@@
local idexpression n;
expression root,e;
@@

 for_each_child_of_node(root,n) {
   ...
(
   of_node_put(n);
|
   e = n
|
+  of_node_put(n);
?  break;
)
   ...
 }
... when != n
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>

---
 drivers/of/platform.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 7b33e03..64daf05 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -409,8 +409,10 @@ int of_platform_bus_probe(struct device_node *root,
 		if (!of_match_node(matches, child))
 			continue;
 		rc = of_platform_bus_create(child, matches, NULL, parent, false);
-		if (rc)
+		if (rc) {
+			of_node_put(child);
 			break;
+		}
 	}
 
 	of_node_put(root);
@@ -451,8 +453,10 @@ int of_platform_populate(struct device_node *root,
 
 	for_each_child_of_node(root, child) {
 		rc = of_platform_bus_create(child, matches, lookup, parent, true);
-		if (rc)
+		if (rc) {
+			of_node_put(child);
 			break;
+		}
 	}
 	of_node_set_flag(root, OF_POPULATED_BUS);
 


^ permalink raw reply related	[flat|nested] 23+ messages in thread

* [PATCH 3/4] of/unittest: add missing of_node_put
       [not found] ` <1445504571-19838-1-git-send-email-Julia.Lawall-L2FTfq7BK8M@public.gmane.org>
@ 2015-10-22  9:02   ` Julia Lawall
  0 siblings, 0 replies; 23+ messages in thread
From: Julia Lawall @ 2015-10-22  9:02 UTC (permalink / raw)
  To: Rob Herring
  Cc: kernel-janitors-u79uwXL29TY76Z2rM5mHXA, Frank Rowand,
	Grant Likely, devicetree-u79uwXL29TY76Z2rM5mHXA,
	linux-kernel-u79uwXL29TY76Z2rM5mHXA

for_each_child_of_node performs an of_node_get on each iteration, so
a break out of the loop requires an of_node_put.

A simplified version of the semantic patch that fixes this problem is as
follows (http://coccinelle.lip6.fr):

// <smpl>
@@
expression root,e;
local idexpression child;
@@

 for_each_child_of_node(root, child) {
   ... when != of_node_put(child)
       when != e = child
(
   return child;
|
+  of_node_put(child);
?  return ...;
)
   ...
 }
// </smpl>

Combine the puts into code at the end of the function, for conciseness.

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>

---
 drivers/of/unittest.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
index 9f71770..e16ea57 100644
--- a/drivers/of/unittest.c
+++ b/drivers/of/unittest.c
@@ -205,16 +205,20 @@ static int __init of_unittest_check_node_linkage(struct device_node *np)
 		if (child->parent != np) {
 			pr_err("Child node %s links to wrong parent %s\n",
 				 child->name, np->name);
-			return -EINVAL;
+			rc = -EINVAL;
+			goto put_child;
 		}
 
 		rc = of_unittest_check_node_linkage(child);
 		if (rc < 0)
-			return rc;
+			goto put_child;
 		count += rc;
 	}
 
 	return count + 1;
+put_child:
+	of_node_put(child);
+	return rc;
 }
 
 static void __init of_unittest_check_tree_linkage(void)


^ permalink raw reply related	[flat|nested] 23+ messages in thread

* [PATCH 4/4] of/irq: add missing of_node_put
  2015-10-22  9:02 [PATCH 0/4] add missing of_node_put Julia Lawall
                   ` (2 preceding siblings ...)
       [not found] ` <1445504571-19838-1-git-send-email-Julia.Lawall-L2FTfq7BK8M@public.gmane.org>
@ 2015-10-22  9:02 ` Julia Lawall
  2015-10-22 13:04 ` [PATCH 0/4] " Rob Herring
                   ` (2 subsequent siblings)
  6 siblings, 0 replies; 23+ messages in thread
From: Julia Lawall @ 2015-10-22  9:02 UTC (permalink / raw)
  To: Rob Herring
  Cc: kernel-janitors, Frank Rowand, Grant Likely, devicetree, linux-kernel

for_each_matching_node performs an of_node_get on each iteration, so
a break out of the loop requires an of_node_put.

A simplified version of the semantic patch that fixes this problem is as
follows (http://coccinelle.lip6.fr):

// <smpl>
@@
local idexpression n;
expression e;
identifier l;
@@

 for_each_matching_node(n,...) {
   ...
(
   of_node_put(n);
|
   e = n
|
+  of_node_put(n);
?  goto l;
)
   ...
 }
...
l: ... when != n
// </smpl>

Besides the issue found by the semantic patch, this code also stores the
device_node value in a list, which requires an of_node_get, and then cleans
up the list on exit from the function, which requires an of_node_put.

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>

---
 drivers/of/irq.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 171798d..902b89b 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -501,10 +501,12 @@ void __init of_irq_init(const struct of_device_id *matches)
 		 * pointer, interrupt-parent device_node etc.
 		 */
 		desc = kzalloc(sizeof(*desc), GFP_KERNEL);
-		if (WARN_ON(!desc))
+		if (WARN_ON(!desc)) {
+			of_node_put(np);
 			goto err;
+		}
 
-		desc->dev = np;
+		desc->dev = of_node_get(np);
 		desc->interrupt_parent = of_irq_find_parent(np);
 		if (desc->interrupt_parent = np)
 			desc->interrupt_parent = NULL;
@@ -575,6 +577,7 @@ void __init of_irq_init(const struct of_device_id *matches)
 err:
 	list_for_each_entry_safe(desc, temp_desc, &intc_desc_list, list) {
 		list_del(&desc->list);
+		of_node_put(desc->dev);
 		kfree(desc);
 	}
 }


^ permalink raw reply related	[flat|nested] 23+ messages in thread

* Re: [PATCH 0/4] add missing of_node_put
  2015-10-22  9:02 [PATCH 0/4] add missing of_node_put Julia Lawall
                   ` (3 preceding siblings ...)
  2015-10-22  9:02 ` [PATCH 4/4] of/irq: " Julia Lawall
@ 2015-10-22 13:04 ` Rob Herring
       [not found]   ` <CAL_JsqJGS+L=FZAwPs-wBSYiX8kQWqZyaLTGhadYVNT3=Qte_Q-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
  2015-10-22 15:08 ` Rob Herring
  2015-11-18 22:04 ` Julia Lawall
  6 siblings, 1 reply; 23+ messages in thread
From: Rob Herring @ 2015-10-22 13:04 UTC (permalink / raw)
  To: Julia Lawall, Russell King - ARM Linux
  Cc: kernel-janitors, Frank Rowand, Grant Likely, devicetree, linux-kernel

+Russell who raised issues with these iterators recently.

On Thu, Oct 22, 2015 at 4:02 AM, Julia Lawall <Julia.Lawall@lip6.fr> wrote:
> The various for_each device_node iterators performs an of_node_get on each
> iteration, so a break out of the loop requires an of_node_put.

Thanks for this.

Are there any plans to use coccinelle as a checker that developers can
run to be warned of these problems?

Rob

> The complete semantic patch that fixes this problem is
> (http://coccinelle.lip6.fr):
>
> // <smpl>
> @r@
> local idexpression n;
> expression e1,e2;
> iterator name for_each_node_by_name, for_each_node_by_type,
> for_each_compatible_node, for_each_matching_node,
> for_each_matching_node_and_match, for_each_child_of_node,
> for_each_available_child_of_node, for_each_node_with_property;
> iterator i;
> statement S;
> expression list [n1] es;
> @@
>
> (
> (
> for_each_node_by_name(n,e1) S
> |
> for_each_node_by_type(n,e1) S
> |
> for_each_compatible_node(n,e1,e2) S
> |
> for_each_matching_node(n,e1) S
> |
> for_each_matching_node_and_match(n,e1,e2) S
> |
> for_each_child_of_node(e1,n) S
> |
> for_each_available_child_of_node(e1,n) S
> |
> for_each_node_with_property(n,e1) S
> )
> &
> i(es,n,...) S
> )
>
> @@
> local idexpression r.n;
> iterator r.i;
> expression e;
> expression list [r.n1] es;
> @@
>
>  i(es,n,...) {
>    ...
> (
>    of_node_put(n);
> |
>    e = n
> |
>    return n;
> |
> +  of_node_put(n);
> ?  return ...;
> )
>    ...
>  }
>
> @@
> local idexpression r.n;
> iterator r.i;
> expression e;
> expression list [r.n1] es;
> @@
>
>  i(es,n,...) {
>    ...
> (
>    of_node_put(n);
> |
>    e = n
> |
> +  of_node_put(n);
> ?  break;
> )
>    ...
>  }
> ... when != n
>
> @@
> local idexpression r.n;
> iterator r.i;
> expression e;
> identifier l;
> expression list [r.n1] es;
> @@
>
>  i(es,n,...) {
>    ...
> (
>    of_node_put(n);
> |
>    e = n
> |
> +  of_node_put(n);
> ?  goto l;
> )
>    ...
>  }
> ...
> l: ... when != n// </smpl>
>
> ---
>
>  drivers/of/irq.c      |    7 +++++--
>  drivers/of/overlay.c  |    5 ++++-
>  drivers/of/platform.c |    8 ++++++--
>  drivers/of/unittest.c |    8 ++++++--
>  4 files changed, 21 insertions(+), 7 deletions(-)

^ permalink raw reply	[flat|nested] 23+ messages in thread

* Re: [PATCH 0/4] add missing of_node_put
       [not found]   ` <CAL_JsqJGS+L=FZAwPs-wBSYiX8kQWqZyaLTGhadYVNT3=Qte_Q-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
@ 2015-10-22 13:19     ` Julia Lawall
  0 siblings, 0 replies; 23+ messages in thread
From: Julia Lawall @ 2015-10-22 13:19 UTC (permalink / raw)
  To: Rob Herring
  Cc: Russell King - ARM Linux, kernel-janitors-u79uwXL29TY76Z2rM5mHXA,
	Frank Rowand, Grant Likely, devicetree-u79uwXL29TY76Z2rM5mHXA,
	linux-kernel-u79uwXL29TY76Z2rM5mHXA



On Thu, 22 Oct 2015, Rob Herring wrote:

> +Russell who raised issues with these iterators recently.
>
> On Thu, Oct 22, 2015 at 4:02 AM, Julia Lawall <Julia.Lawall@lip6.fr> wrote:
> > The various for_each device_node iterators performs an of_node_get on each
> > iteration, so a break out of the loop requires an of_node_put.
>
> Thanks for this.
>
> Are there any plans to use coccinelle as a checker that developers can
> run to be warned of these problems?

There are three issues I have found so far:

1.  of_node_put before a continue
2.  missing of_node_put before a break
3.  missing of_node get before some more permanent storage of the value

The semantic patches for the first two seem to be working pretty well, so
I could submit them for integration into the kernel.  The third one, I
have only looked at in an ad hoc way so far.

julia

>
> Rob
>
> > The complete semantic patch that fixes this problem is
> > (http://coccinelle.lip6.fr):
> >
> > // <smpl>
> > @r@
> > local idexpression n;
> > expression e1,e2;
> > iterator name for_each_node_by_name, for_each_node_by_type,
> > for_each_compatible_node, for_each_matching_node,
> > for_each_matching_node_and_match, for_each_child_of_node,
> > for_each_available_child_of_node, for_each_node_with_property;
> > iterator i;
> > statement S;
> > expression list [n1] es;
> > @@
> >
> > (
> > (
> > for_each_node_by_name(n,e1) S
> > |
> > for_each_node_by_type(n,e1) S
> > |
> > for_each_compatible_node(n,e1,e2) S
> > |
> > for_each_matching_node(n,e1) S
> > |
> > for_each_matching_node_and_match(n,e1,e2) S
> > |
> > for_each_child_of_node(e1,n) S
> > |
> > for_each_available_child_of_node(e1,n) S
> > |
> > for_each_node_with_property(n,e1) S
> > )
> > &
> > i(es,n,...) S
> > )
> >
> > @@
> > local idexpression r.n;
> > iterator r.i;
> > expression e;
> > expression list [r.n1] es;
> > @@
> >
> >  i(es,n,...) {
> >    ...
> > (
> >    of_node_put(n);
> > |
> >    e = n
> > |
> >    return n;
> > |
> > +  of_node_put(n);
> > ?  return ...;
> > )
> >    ...
> >  }
> >
> > @@
> > local idexpression r.n;
> > iterator r.i;
> > expression e;
> > expression list [r.n1] es;
> > @@
> >
> >  i(es,n,...) {
> >    ...
> > (
> >    of_node_put(n);
> > |
> >    e = n
> > |
> > +  of_node_put(n);
> > ?  break;
> > )
> >    ...
> >  }
> > ... when != n
> >
> > @@
> > local idexpression r.n;
> > iterator r.i;
> > expression e;
> > identifier l;
> > expression list [r.n1] es;
> > @@
> >
> >  i(es,n,...) {
> >    ...
> > (
> >    of_node_put(n);
> > |
> >    e = n
> > |
> > +  of_node_put(n);
> > ?  goto l;
> > )
> >    ...
> >  }
> > ...
> > l: ... when != n// </smpl>
> >
> > ---
> >
> >  drivers/of/irq.c      |    7 +++++--
> >  drivers/of/overlay.c  |    5 ++++-
> >  drivers/of/platform.c |    8 ++++++--
> >  drivers/of/unittest.c |    8 ++++++--
> >  4 files changed, 21 insertions(+), 7 deletions(-)
> --
> To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>

^ permalink raw reply	[flat|nested] 23+ messages in thread

* Re: [PATCH 0/4] add missing of_node_put
  2015-10-22  9:02 [PATCH 0/4] add missing of_node_put Julia Lawall
                   ` (4 preceding siblings ...)
  2015-10-22 13:04 ` [PATCH 0/4] " Rob Herring
@ 2015-10-22 15:08 ` Rob Herring
  2015-11-18 22:04 ` Julia Lawall
  6 siblings, 0 replies; 23+ messages in thread
From: Rob Herring @ 2015-10-22 15:08 UTC (permalink / raw)
  To: Julia Lawall
  Cc: kernel-janitors, Frank Rowand, Grant Likely, devicetree, linux-kernel

On Thu, Oct 22, 2015 at 4:02 AM, Julia Lawall <Julia.Lawall@lip6.fr> wrote:
> The various for_each device_node iterators performs an of_node_get on each
> iteration, so a break out of the loop requires an of_node_put.

> ---
>
>  drivers/of/irq.c      |    7 +++++--
>  drivers/of/overlay.c  |    5 ++++-
>  drivers/of/platform.c |    8 ++++++--
>  drivers/of/unittest.c |    8 ++++++--
>  4 files changed, 21 insertions(+), 7 deletions(-)

Series applied, thanks.

Rob

^ permalink raw reply	[flat|nested] 23+ messages in thread

* [PATCH 0/4] add missing of_node_put
  2015-10-22  9:02 [PATCH 0/4] add missing of_node_put Julia Lawall
                   ` (5 preceding siblings ...)
  2015-10-22 15:08 ` Rob Herring
@ 2015-11-18 22:04 ` Julia Lawall
  2015-11-18 22:04   ` [PATCH 1/4] mtd: brcmnand: improve memory management Julia Lawall
                     ` (3 more replies)
  6 siblings, 4 replies; 23+ messages in thread
From: Julia Lawall @ 2015-11-18 22:04 UTC (permalink / raw)
  To: linux-arm-kernel

The various for_each device_node iterators performs an of_node_get on each
iteration, so a break out of the loop requires an of_node_put.

The complete semantic patch that fixes this problem is
(http://coccinelle.lip6.fr):

// <smpl>
@r@
local idexpression n;
expression e1,e2;
iterator name for_each_node_by_name, for_each_node_by_type,
for_each_compatible_node, for_each_matching_node,
for_each_matching_node_and_match, for_each_child_of_node,
for_each_available_child_of_node, for_each_node_with_property;
iterator i;
statement S;
expression list [n1] es;
@@

(
(
for_each_node_by_name(n,e1) S
|
for_each_node_by_type(n,e1) S
|
for_each_compatible_node(n,e1,e2) S
|
for_each_matching_node(n,e1) S
|
for_each_matching_node_and_match(n,e1,e2) S
|
for_each_child_of_node(e1,n) S
|
for_each_available_child_of_node(e1,n) S
|
for_each_node_with_property(n,e1) S
)
&
i(es,n,...) S
)

@@
local idexpression r.n;
iterator r.i;
expression e;
expression list [r.n1] es;
@@

 i(es,n,...) {
   ...
(
   of_node_put(n);
|
   e = n
|
   return n;
|
+  of_node_put(n);
?  return ...;
)
   ...
 }

@@
local idexpression r.n;
iterator r.i;
expression e;
expression list [r.n1] es;
@@

 i(es,n,...) {
   ...
(
   of_node_put(n);
|
   e = n
|
+  of_node_put(n);
?  break;
)
   ...
 }
... when != n

@@
local idexpression r.n;
iterator r.i;
expression e;
identifier l;
expression list [r.n1] es;
@@

 i(es,n,...) {
   ...
(
   of_node_put(n);
|
   e = n
|
+  of_node_put(n);
?  goto l;
)
   ...
 }
...
l: ... when != n// </smpl>

---

 drivers/iio/adc/qcom-spmi-vadc.c     |    4 +++-
 drivers/mtd/nand/brcmnand/brcmnand.c |   14 ++++++++++----
 drivers/mtd/nand/sunxi_nand.c        |    4 +++-
 drivers/power/reset/at91-reset.c     |    1 +
 4 files changed, 17 insertions(+), 6 deletions(-)

^ permalink raw reply	[flat|nested] 23+ messages in thread

* [PATCH 1/4] mtd: brcmnand: improve memory management
  2015-11-18 22:04 ` Julia Lawall
@ 2015-11-18 22:04   ` Julia Lawall
  2015-11-18 22:44     ` Brian Norris
  2015-11-18 22:04   ` [PATCH 2/4] mtd: nand: sunxi: add missing of_node_put Julia Lawall
                     ` (2 subsequent siblings)
  3 siblings, 1 reply; 23+ messages in thread
From: Julia Lawall @ 2015-11-18 22:04 UTC (permalink / raw)
  To: Brian Norris
  Cc: kernel-janitors, David Woodhouse, linux-mtd,
	bcm-kernel-feedback-list, linux-kernel, Russell King - ARM Linux,
	Thomas Petazzoni, Andrew Lunn, Bjorn Helgaas, Jason Cooper

This patch addresses several related memory management issues in the probe
function:

1. for_each_available_child_of_node performs an of_node_get on each
iteration, so a break out of the loop requires an of_node_put.

A simplified version of the semantic patch that fixes this problem is as
follows (http://coccinelle.lip6.fr):

// <smpl>
@@
expression root,e;
local idexpression child;
@@

 for_each_available_child_of_node(root, child) {
   ... when != of_node_put(child)
       when != e = child
(
   return child;
|
+  of_node_put(child);
?  return ...;
)
   ...
 }
// </smpl>

2. The devm_kzalloc'd data is not used if brcmnand_init_cs fails.  Free it
immediately, using devm_kfree in this case, instead of waiting for the
remove function.

3. If the continue is not taken, then host is added to a list, that has a
lifetime beyond the end of the for_each_available_child_of_node loop body.
Thus, of_node_get is needed on child, which is referenced by host.  A
corresponding of_node_put is needed in the remove function.

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>

---

One could consider whether the of_node_get should be on host->of_node,
which looks more similar to the thing that is stored in the list.  I used
child, to be more similar to the of_node_put in the same function.

 drivers/mtd/nand/brcmnand/brcmnand.c |   14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c
index 2a437c7..b0cb55d 100644
--- a/drivers/mtd/nand/brcmnand/brcmnand.c
+++ b/drivers/mtd/nand/brcmnand/brcmnand.c
@@ -2237,16 +2237,20 @@ int brcmnand_probe(struct platform_device *pdev, struct brcmnand_soc *soc)
 			struct brcmnand_host *host;
 
 			host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL);
-			if (!host)
+			if (!host) {
+				of_node_put(child);
 				return -ENOMEM;
+			}
 			host->pdev = pdev;
 			host->ctrl = ctrl;
 			host->of_node = child;
 
 			ret = brcmnand_init_cs(host);
-			if (ret)
+			if (ret) {
+				devm_kfree(dev, host);
 				continue; /* Try all chip-selects */
-
+			}
+			of_node_get(child);
 			list_add_tail(&host->node, &ctrl->host_list);
 		}
 	}
@@ -2264,8 +2268,10 @@ int brcmnand_remove(struct platform_device *pdev)
 	struct brcmnand_controller *ctrl = dev_get_drvdata(&pdev->dev);
 	struct brcmnand_host *host;
 
-	list_for_each_entry(host, &ctrl->host_list, node)
+	list_for_each_entry(host, &ctrl->host_list, node) {
+		of_node_put(host->of_node);
 		nand_release(&host->mtd);
+	}
 
 	dev_set_drvdata(&pdev->dev, NULL);
 


^ permalink raw reply related	[flat|nested] 23+ messages in thread

* [PATCH 2/4] mtd: nand: sunxi: add missing of_node_put
  2015-11-18 22:04 ` Julia Lawall
  2015-11-18 22:04   ` [PATCH 1/4] mtd: brcmnand: improve memory management Julia Lawall
@ 2015-11-18 22:04   ` Julia Lawall
  2015-11-23  7:26     ` Chen-Yu Tsai
                       ` (2 more replies)
  2015-11-18 22:04   ` [PATCH 3/4] iio: adc: spmi-vadc: " Julia Lawall
  2015-11-18 22:04   ` [PATCH 4/4] power/reset: at91-reset: " Julia Lawall
  3 siblings, 3 replies; 23+ messages in thread
From: Julia Lawall @ 2015-11-18 22:04 UTC (permalink / raw)
  To: linux-arm-kernel

for_each_child_of_node performs an of_node_get on each iteration, so
a break out of the loop requires an of_node_put.

A simplified version of the semantic patch that fixes this problem is as
follows (http://coccinelle.lip6.fr):

// <smpl>
@@
expression root,e;
local idexpression child;
@@

 for_each_child_of_node(root, child) {
   ... when != of_node_put(child)
       when != e = child
(
   return child;
|
+  of_node_put(child);
?  return ...;
)
   ...
 }
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>

---
 drivers/mtd/nand/sunxi_nand.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/mtd/nand/sunxi_nand.c b/drivers/mtd/nand/sunxi_nand.c
index 2ed52e4..1bbcc0c 100644
--- a/drivers/mtd/nand/sunxi_nand.c
+++ b/drivers/mtd/nand/sunxi_nand.c
@@ -1391,8 +1391,10 @@ static int sunxi_nand_chips_init(struct device *dev, struct sunxi_nfc *nfc)
 
 	for_each_child_of_node(np, nand_np) {
 		ret = sunxi_nand_chip_init(dev, nfc, nand_np);
-		if (ret)
+		if (ret) {
+			of_node_put(nand_np);
 			return ret;
+		}
 	}
 
 	return 0;


^ permalink raw reply related	[flat|nested] 23+ messages in thread

* [PATCH 3/4] iio: adc: spmi-vadc: add missing of_node_put
  2015-11-18 22:04 ` Julia Lawall
  2015-11-18 22:04   ` [PATCH 1/4] mtd: brcmnand: improve memory management Julia Lawall
  2015-11-18 22:04   ` [PATCH 2/4] mtd: nand: sunxi: add missing of_node_put Julia Lawall
@ 2015-11-18 22:04   ` Julia Lawall
  2015-11-21 18:25     ` Jonathan Cameron
  2015-11-18 22:04   ` [PATCH 4/4] power/reset: at91-reset: " Julia Lawall
  3 siblings, 1 reply; 23+ messages in thread
From: Julia Lawall @ 2015-11-18 22:04 UTC (permalink / raw)
  To: Jonathan Cameron
  Cc: kernel-janitors, Hartmut Knaack, Lars-Peter Clausen,
	Peter Meerwald, linux-iio, linux-kernel,
	Russell King - ARM Linux, Thomas Petazzoni, Andrew Lunn,
	Bjorn Helgaas, Jason Cooper

for_each_available_child_of_node performs an of_node_get on each iteration,
so a break out of the loop requires an of_node_put.

A simplified version of the semantic patch that fixes this problem is as
follows (http://coccinelle.lip6.fr):

// <smpl>
@@
expression root,e;
local idexpression child;
@@

 for_each_available_child_of_node(root, child) {
   ... when != of_node_put(child)
       when != e = child
(
   return child;
|
+  of_node_put(child);
?  return ...;
)
   ...
 }
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>

---
 drivers/iio/adc/qcom-spmi-vadc.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/adc/qcom-spmi-vadc.c b/drivers/iio/adc/qcom-spmi-vadc.c
index 0c4618b..c2babe5 100644
--- a/drivers/iio/adc/qcom-spmi-vadc.c
+++ b/drivers/iio/adc/qcom-spmi-vadc.c
@@ -839,8 +839,10 @@ static int vadc_get_dt_data(struct vadc_priv *vadc, struct device_node *node)
 
 	for_each_available_child_of_node(node, child) {
 		ret = vadc_get_dt_channel_data(vadc->dev, &prop, child);
-		if (ret)
+		if (ret) {
+			of_node_put(child);
 			return ret;
+		}
 
 		vadc->chan_props[index] = prop;
 


^ permalink raw reply related	[flat|nested] 23+ messages in thread

* [PATCH 4/4] power/reset: at91-reset: add missing of_node_put
  2015-11-18 22:04 ` Julia Lawall
                     ` (2 preceding siblings ...)
  2015-11-18 22:04   ` [PATCH 3/4] iio: adc: spmi-vadc: " Julia Lawall
@ 2015-11-18 22:04   ` Julia Lawall
  2015-12-05  0:42     ` Sebastian Reichel
  3 siblings, 1 reply; 23+ messages in thread
From: Julia Lawall @ 2015-11-18 22:04 UTC (permalink / raw)
  To: Sebastian Reichel
  Cc: kernel-janitors, Dmitry Eremin-Solenikov, David Woodhouse,
	linux-pm, linux-kernel, Russell King - ARM Linux,
	Thomas Petazzoni, Andrew Lunn, Bjorn Helgaas, Jason Cooper

for_each_matching_node performs an of_node_get on each iteration, so
a break out of the loop requires an of_node_put.

A simplified version of the semantic patch that fixes this problem is as
follows (http://coccinelle.lip6.fr):

// <smpl>
@@
expression e,e1;
local idexpression np;
@@

 for_each_matching_node(np, e1) {
   ... when != of_node_put(np)
       when != e = np
(
   return np;
|
+  of_node_put(np);
?  return ...;
)
   ...
 }
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>

---
 drivers/power/reset/at91-reset.c |    1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/power/reset/at91-reset.c b/drivers/power/reset/at91-reset.c
index 3f6b5dd..1b5d450 100644
--- a/drivers/power/reset/at91-reset.c
+++ b/drivers/power/reset/at91-reset.c
@@ -198,6 +198,7 @@ static int __init at91_reset_probe(struct platform_device *pdev)
 			at91_ramc_base[idx] = of_iomap(np, 0);
 			if (!at91_ramc_base[idx]) {
 				dev_err(&pdev->dev, "Could not map ram controller address\n");
+				of_node_put(np);
 				return -ENODEV;
 			}
 			idx++;


^ permalink raw reply related	[flat|nested] 23+ messages in thread

* Re: [PATCH 1/4] mtd: brcmnand: improve memory management
  2015-11-18 22:04   ` [PATCH 1/4] mtd: brcmnand: improve memory management Julia Lawall
@ 2015-11-18 22:44     ` Brian Norris
  2015-11-19  6:13       ` Julia Lawall
  0 siblings, 1 reply; 23+ messages in thread
From: Brian Norris @ 2015-11-18 22:44 UTC (permalink / raw)
  To: Julia Lawall
  Cc: kernel-janitors, David Woodhouse, linux-mtd,
	bcm-kernel-feedback-list, linux-kernel, Russell King - ARM Linux,
	Thomas Petazzoni, Andrew Lunn, Bjorn Helgaas, Jason Cooper,
	Kamal Dasu

On Wed, Nov 18, 2015 at 11:04:11PM +0100, Julia Lawall wrote:
> This patch addresses several related memory management issues in the probe
> function:
> 
> 1. for_each_available_child_of_node performs an of_node_get on each
> iteration, so a break out of the loop requires an of_node_put.
> 
> A simplified version of the semantic patch that fixes this problem is as
> follows (http://coccinelle.lip6.fr):
> 
> // <smpl>
> @@
> expression root,e;
> local idexpression child;
> @@
> 
>  for_each_available_child_of_node(root, child) {
>    ... when != of_node_put(child)
>        when != e = child
> (
>    return child;
> |
> +  of_node_put(child);
> ?  return ...;
> )
>    ...
>  }
> // </smpl>

Good catch again

> 2. The devm_kzalloc'd data is not used if brcmnand_init_cs fails.  Free it
> immediately, using devm_kfree in this case, instead of waiting for the
> remove function.

Same

> 3. If the continue is not taken, then host is added to a list, that has a
> lifetime beyond the end of the for_each_available_child_of_node loop body.
> Thus, of_node_get is needed on child, which is referenced by host.  A
> corresponding of_node_put is needed in the remove function.

This one's a bit silly. We really shouldn't be keeping the reference in
'host' at all. Also, as of commit 215a02fd3087 ("mtd: grab a reference to
the MTD of_node before registering it"), the MTD core will actually be
refcounting the node for us, too, so this isn't really necessary.

I have a patch to remove brcmnand_host::of_node (appended below), which
should make this step obsolete, and be more obvious that no extra
of_node_get()'ing is required.

> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
> 
> ---
> 
> One could consider whether the of_node_get should be on host->of_node,
> which looks more similar to the thing that is stored in the list.  I used
> child, to be more similar to the of_node_put in the same function.
> 
>  drivers/mtd/nand/brcmnand/brcmnand.c |   14 ++++++++++----
>  1 file changed, 10 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c
> index 2a437c7..b0cb55d 100644
> --- a/drivers/mtd/nand/brcmnand/brcmnand.c
> +++ b/drivers/mtd/nand/brcmnand/brcmnand.c
> @@ -2237,16 +2237,20 @@ int brcmnand_probe(struct platform_device *pdev, struct brcmnand_soc *soc)
>  			struct brcmnand_host *host;
>  
>  			host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL);
> -			if (!host)
> +			if (!host) {
> +				of_node_put(child);
>  				return -ENOMEM;

In code reading, I noticed that we don't actually cleanup for prior
iterations of brcmnand_init_cs() here. i.e., if we're exiting here, we
should be doing nand_release() on all previously-registered chips.

> +			}
>  			host->pdev = pdev;
>  			host->ctrl = ctrl;
>  			host->of_node = child;
>  
>  			ret = brcmnand_init_cs(host);
> -			if (ret)
> +			if (ret) {
> +				devm_kfree(dev, host);
>  				continue; /* Try all chip-selects */
> -
> +			}
> +			of_node_get(child);
>  			list_add_tail(&host->node, &ctrl->host_list);
>  		}
>  	}
> @@ -2264,8 +2268,10 @@ int brcmnand_remove(struct platform_device *pdev)
>  	struct brcmnand_controller *ctrl = dev_get_drvdata(&pdev->dev);
>  	struct brcmnand_host *host;
>  
> -	list_for_each_entry(host, &ctrl->host_list, node)
> +	list_for_each_entry(host, &ctrl->host_list, node) {
> +		of_node_put(host->of_node);
>  		nand_release(&host->mtd);
> +	}
>  
>  	dev_set_drvdata(&pdev->dev, NULL);
>  

Patch to kill off some of this:

---8<---
From 6c51a9ef1325e7b06a7623c1fbca1adf6eeb8253 Mon Sep 17 00:00:00 2001
From: Brian Norris <computersforpeace@gmail.com>
Date: Wed, 18 Nov 2015 14:33:24 -0800
Subject: [PATCH] mtd: brcmnand: drop brcmnand_host::of_node field

We don't actually need to stash a copy of this device_node indefinitely;
we only need it in brcmnand_init_cs().

Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Cc: <bcm-kernel-feedback-list@broadcom.com>
Cc: Kamal Dasu <kdasu.kdev@gmail.com>
---
 drivers/mtd/nand/brcmnand/brcmnand.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c
index c395b4a75fb1..351438a62aaa 100644
--- a/drivers/mtd/nand/brcmnand/brcmnand.c
+++ b/drivers/mtd/nand/brcmnand/brcmnand.c
@@ -176,7 +176,6 @@ struct brcmnand_cfg {
 
 struct brcmnand_host {
 	struct list_head	node;
-	struct device_node	*of_node;
 
 	struct nand_chip	chip;
 	struct mtd_info		mtd;
@@ -1896,10 +1895,9 @@ static int brcmnand_setup_dev(struct brcmnand_host *host)
 	return 0;
 }
 
-static int brcmnand_init_cs(struct brcmnand_host *host)
+static int brcmnand_init_cs(struct brcmnand_host *host, struct device_node *dn)
 {
 	struct brcmnand_controller *ctrl = host->ctrl;
-	struct device_node *dn = host->of_node;
 	struct platform_device *pdev = host->pdev;
 	struct mtd_info *mtd;
 	struct nand_chip *chip;
@@ -2231,9 +2229,8 @@ int brcmnand_probe(struct platform_device *pdev, struct brcmnand_soc *soc)
 				return -ENOMEM;
 			host->pdev = pdev;
 			host->ctrl = ctrl;
-			host->of_node = child;
 
-			ret = brcmnand_init_cs(host);
+			ret = brcmnand_init_cs(host, child);
 			if (ret)
 				continue; /* Try all chip-selects */
 
-- 
2.6.0.rc2.230.g3dd15c0


^ permalink raw reply related	[flat|nested] 23+ messages in thread

* Re: [PATCH 1/4] mtd: brcmnand: improve memory management
  2015-11-18 22:44     ` Brian Norris
@ 2015-11-19  6:13       ` Julia Lawall
  2015-11-19 19:26         ` Brian Norris
  0 siblings, 1 reply; 23+ messages in thread
From: Julia Lawall @ 2015-11-19  6:13 UTC (permalink / raw)
  To: Brian Norris
  Cc: kernel-janitors, David Woodhouse, linux-mtd,
	bcm-kernel-feedback-list, linux-kernel, Russell King - ARM Linux,
	Thomas Petazzoni, Andrew Lunn, Bjorn Helgaas, Jason Cooper,
	Kamal Dasu



On Wed, 18 Nov 2015, Brian Norris wrote:

> On Wed, Nov 18, 2015 at 11:04:11PM +0100, Julia Lawall wrote:
> > This patch addresses several related memory management issues in the probe
> > function:
> > 
> > 1. for_each_available_child_of_node performs an of_node_get on each
> > iteration, so a break out of the loop requires an of_node_put.
> > 
> > A simplified version of the semantic patch that fixes this problem is as
> > follows (http://coccinelle.lip6.fr):
> > 
> > // <smpl>
> > @@
> > expression root,e;
> > local idexpression child;
> > @@
> > 
> >  for_each_available_child_of_node(root, child) {
> >    ... when != of_node_put(child)
> >        when != e = child
> > (
> >    return child;
> > |
> > +  of_node_put(child);
> > ?  return ...;
> > )
> >    ...
> >  }
> > // </smpl>
> 
> Good catch again
> 
> > 2. The devm_kzalloc'd data is not used if brcmnand_init_cs fails.  Free it
> > immediately, using devm_kfree in this case, instead of waiting for the
> > remove function.
> 
> Same
> 
> > 3. If the continue is not taken, then host is added to a list, that has a
> > lifetime beyond the end of the for_each_available_child_of_node loop body.
> > Thus, of_node_get is needed on child, which is referenced by host.  A
> > corresponding of_node_put is needed in the remove function.
> 
> This one's a bit silly. We really shouldn't be keeping the reference in
> 'host' at all. Also, as of commit 215a02fd3087 ("mtd: grab a reference to
> the MTD of_node before registering it"), the MTD core will actually be
> refcounting the node for us, too, so this isn't really necessary.
> 
> I have a patch to remove brcmnand_host::of_node (appended below), which
> should make this step obsolete, and be more obvious that no extra
> of_node_get()'ing is required.

OK.  Should I resend my patch without this change?

julia

> > Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
> > 
> > ---
> > 
> > One could consider whether the of_node_get should be on host->of_node,
> > which looks more similar to the thing that is stored in the list.  I used
> > child, to be more similar to the of_node_put in the same function.
> > 
> >  drivers/mtd/nand/brcmnand/brcmnand.c |   14 ++++++++++----
> >  1 file changed, 10 insertions(+), 4 deletions(-)
> > 
> > diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c
> > index 2a437c7..b0cb55d 100644
> > --- a/drivers/mtd/nand/brcmnand/brcmnand.c
> > +++ b/drivers/mtd/nand/brcmnand/brcmnand.c
> > @@ -2237,16 +2237,20 @@ int brcmnand_probe(struct platform_device *pdev, struct brcmnand_soc *soc)
> >  			struct brcmnand_host *host;
> >  
> >  			host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL);
> > -			if (!host)
> > +			if (!host) {
> > +				of_node_put(child);
> >  				return -ENOMEM;
> 
> In code reading, I noticed that we don't actually cleanup for prior
> iterations of brcmnand_init_cs() here. i.e., if we're exiting here, we
> should be doing nand_release() on all previously-registered chips.
> 
> > +			}
> >  			host->pdev = pdev;
> >  			host->ctrl = ctrl;
> >  			host->of_node = child;
> >  
> >  			ret = brcmnand_init_cs(host);
> > -			if (ret)
> > +			if (ret) {
> > +				devm_kfree(dev, host);
> >  				continue; /* Try all chip-selects */
> > -
> > +			}
> > +			of_node_get(child);
> >  			list_add_tail(&host->node, &ctrl->host_list);
> >  		}
> >  	}
> > @@ -2264,8 +2268,10 @@ int brcmnand_remove(struct platform_device *pdev)
> >  	struct brcmnand_controller *ctrl = dev_get_drvdata(&pdev->dev);
> >  	struct brcmnand_host *host;
> >  
> > -	list_for_each_entry(host, &ctrl->host_list, node)
> > +	list_for_each_entry(host, &ctrl->host_list, node) {
> > +		of_node_put(host->of_node);
> >  		nand_release(&host->mtd);
> > +	}
> >  
> >  	dev_set_drvdata(&pdev->dev, NULL);
> >  
> 
> Patch to kill off some of this:
> 
> ---8<---
> From 6c51a9ef1325e7b06a7623c1fbca1adf6eeb8253 Mon Sep 17 00:00:00 2001
> From: Brian Norris <computersforpeace@gmail.com>
> Date: Wed, 18 Nov 2015 14:33:24 -0800
> Subject: [PATCH] mtd: brcmnand: drop brcmnand_host::of_node field
> 
> We don't actually need to stash a copy of this device_node indefinitely;
> we only need it in brcmnand_init_cs().
> 
> Signed-off-by: Brian Norris <computersforpeace@gmail.com>
> Cc: <bcm-kernel-feedback-list@broadcom.com>
> Cc: Kamal Dasu <kdasu.kdev@gmail.com>
> ---
>  drivers/mtd/nand/brcmnand/brcmnand.c | 7 ++-----
>  1 file changed, 2 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c
> index c395b4a75fb1..351438a62aaa 100644
> --- a/drivers/mtd/nand/brcmnand/brcmnand.c
> +++ b/drivers/mtd/nand/brcmnand/brcmnand.c
> @@ -176,7 +176,6 @@ struct brcmnand_cfg {
>  
>  struct brcmnand_host {
>  	struct list_head	node;
> -	struct device_node	*of_node;
>  
>  	struct nand_chip	chip;
>  	struct mtd_info		mtd;
> @@ -1896,10 +1895,9 @@ static int brcmnand_setup_dev(struct brcmnand_host *host)
>  	return 0;
>  }
>  
> -static int brcmnand_init_cs(struct brcmnand_host *host)
> +static int brcmnand_init_cs(struct brcmnand_host *host, struct device_node *dn)
>  {
>  	struct brcmnand_controller *ctrl = host->ctrl;
> -	struct device_node *dn = host->of_node;
>  	struct platform_device *pdev = host->pdev;
>  	struct mtd_info *mtd;
>  	struct nand_chip *chip;
> @@ -2231,9 +2229,8 @@ int brcmnand_probe(struct platform_device *pdev, struct brcmnand_soc *soc)
>  				return -ENOMEM;
>  			host->pdev = pdev;
>  			host->ctrl = ctrl;
> -			host->of_node = child;
>  
> -			ret = brcmnand_init_cs(host);
> +			ret = brcmnand_init_cs(host, child);
>  			if (ret)
>  				continue; /* Try all chip-selects */
>  
> -- 
> 2.6.0.rc2.230.g3dd15c0
> 
> --
> To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

^ permalink raw reply	[flat|nested] 23+ messages in thread

* Re: [PATCH 1/4] mtd: brcmnand: improve memory management
  2015-11-19  6:13       ` Julia Lawall
@ 2015-11-19 19:26         ` Brian Norris
  2015-11-19 21:32           ` [PATCH 1/4 v2] " Julia Lawall
  0 siblings, 1 reply; 23+ messages in thread
From: Brian Norris @ 2015-11-19 19:26 UTC (permalink / raw)
  To: Julia Lawall
  Cc: kernel-janitors, David Woodhouse, linux-mtd,
	bcm-kernel-feedback-list, linux-kernel, Russell King - ARM Linux,
	Thomas Petazzoni, Andrew Lunn, Bjorn Helgaas, Jason Cooper,
	Kamal Dasu

On Thu, Nov 19, 2015 at 07:13:45AM +0100, Julia Lawall wrote:
> On Wed, 18 Nov 2015, Brian Norris wrote:
> > On Wed, Nov 18, 2015 at 11:04:11PM +0100, Julia Lawall wrote:
> > > 3. If the continue is not taken, then host is added to a list, that has a
> > > lifetime beyond the end of the for_each_available_child_of_node loop body.
> > > Thus, of_node_get is needed on child, which is referenced by host.  A
> > > corresponding of_node_put is needed in the remove function.
> > 
> > This one's a bit silly. We really shouldn't be keeping the reference in
> > 'host' at all. Also, as of commit 215a02fd3087 ("mtd: grab a reference to
> > the MTD of_node before registering it"), the MTD core will actually be
> > refcounting the node for us, too, so this isn't really necessary.
> > 
> > I have a patch to remove brcmnand_host::of_node (appended below), which
> > should make this step obsolete, and be more obvious that no extra
> > of_node_get()'ing is required.
> 
> OK.  Should I resend my patch without this change?

Sure, that'd be good. Then I could merge/rebase mine on top.

Thanks,
Brian

^ permalink raw reply	[flat|nested] 23+ messages in thread

* [PATCH 1/4 v2] mtd: brcmnand: improve memory management
  2015-11-19 19:26         ` Brian Norris
@ 2015-11-19 21:32           ` Julia Lawall
  2015-12-01  1:56             ` Brian Norris
  0 siblings, 1 reply; 23+ messages in thread
From: Julia Lawall @ 2015-11-19 21:32 UTC (permalink / raw)
  To: Brian Norris
  Cc: kernel-janitors, David Woodhouse, linux-mtd,
	bcm-kernel-feedback-list, linux-kernel, Russell King - ARM Linux,
	Thomas Petazzoni, Andrew Lunn, Bjorn Helgaas, Jason Cooper,
	Kamal Dasu

This patch addresses two related memory management issues in the probe
function:

1. for_each_available_child_of_node performs an of_node_get on each
iteration, so a break out of the loop requires an of_node_put.

A simplified version of the semantic patch that fixes this problem is as
follows (http://coccinelle.lip6.fr):

// <smpl>
@@
expression root,e;
local idexpression child;
@@

 for_each_available_child_of_node(root, child) {
   ... when != of_node_put(child)
       when != e = child
(
   return child;
|
+  of_node_put(child);
?  return ...;
)
   ...
 }
// </smpl>

2. The devm_kzalloc'd data is not used if brcmnand_init_cs fails.  Free it
immediately, using devm_kfree in this case, instead of waiting for the
remove function.

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>

---

v2: Drop of_node_get addition, as another patch will get rid of the need
for it completely.

 drivers/mtd/nand/brcmnand/brcmnand.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c
index 2a437c7..551d474 100644
--- a/drivers/mtd/nand/brcmnand/brcmnand.c
+++ b/drivers/mtd/nand/brcmnand/brcmnand.c
@@ -2237,15 +2237,19 @@ int brcmnand_probe(struct platform_device *pdev, struct brcmnand_soc *soc)
 			struct brcmnand_host *host;
 
 			host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL);
-			if (!host)
+			if (!host) {
+				of_node_put(child);
 				return -ENOMEM;
+			}
 			host->pdev = pdev;
 			host->ctrl = ctrl;
 			host->of_node = child;
 
 			ret = brcmnand_init_cs(host);
-			if (ret)
+			if (ret) {
+				devm_kfree(dev, host);
 				continue; /* Try all chip-selects */
+			}
 
 			list_add_tail(&host->node, &ctrl->host_list);
 		}

^ permalink raw reply related	[flat|nested] 23+ messages in thread

* Re: [PATCH 3/4] iio: adc: spmi-vadc: add missing of_node_put
  2015-11-18 22:04   ` [PATCH 3/4] iio: adc: spmi-vadc: " Julia Lawall
@ 2015-11-21 18:25     ` Jonathan Cameron
  0 siblings, 0 replies; 23+ messages in thread
From: Jonathan Cameron @ 2015-11-21 18:25 UTC (permalink / raw)
  To: Julia Lawall
  Cc: kernel-janitors, Hartmut Knaack, Lars-Peter Clausen,
	Peter Meerwald, linux-iio, linux-kernel,
	Russell King - ARM Linux, Thomas Petazzoni, Andrew Lunn,
	Bjorn Helgaas, Jason Cooper

On 18/11/15 22:04, Julia Lawall wrote:
> for_each_available_child_of_node performs an of_node_get on each iteration,
> so a break out of the loop requires an of_node_put.
> 
> A simplified version of the semantic patch that fixes this problem is as
> follows (http://coccinelle.lip6.fr):
> 
> // <smpl>
> @@
> expression root,e;
> local idexpression child;
> @@
> 
>  for_each_available_child_of_node(root, child) {
>    ... when != of_node_put(child)
>        when != e = child
> (
>    return child;
> |
> +  of_node_put(child);
> ?  return ...;
> )
>    ...
>  }
> // </smpl>
> 
> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Thanks. Applied to the fixes-togreg branch of iio.git and marked for stable.

Jonathan
> 
> ---
>  drivers/iio/adc/qcom-spmi-vadc.c |    4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/adc/qcom-spmi-vadc.c b/drivers/iio/adc/qcom-spmi-vadc.c
> index 0c4618b..c2babe5 100644
> --- a/drivers/iio/adc/qcom-spmi-vadc.c
> +++ b/drivers/iio/adc/qcom-spmi-vadc.c
> @@ -839,8 +839,10 @@ static int vadc_get_dt_data(struct vadc_priv *vadc, struct device_node *node)
>  
>  	for_each_available_child_of_node(node, child) {
>  		ret = vadc_get_dt_channel_data(vadc->dev, &prop, child);
> -		if (ret)
> +		if (ret) {
> +			of_node_put(child);
>  			return ret;
> +		}
>  
>  		vadc->chan_props[index] = prop;
>  
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-iio" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 


^ permalink raw reply	[flat|nested] 23+ messages in thread

* Re: [PATCH 2/4] mtd: nand: sunxi: add missing of_node_put
  2015-11-18 22:04   ` [PATCH 2/4] mtd: nand: sunxi: add missing of_node_put Julia Lawall
@ 2015-11-23  7:26     ` Chen-Yu Tsai
  2015-11-23 13:59     ` Boris Brezillon
  2015-12-01  1:56     ` Brian Norris
  2 siblings, 0 replies; 23+ messages in thread
From: Chen-Yu Tsai @ 2015-11-23  7:26 UTC (permalink / raw)
  To: linux-arm-kernel

On Thu, Nov 19, 2015 at 6:04 AM, Julia Lawall <Julia.Lawall@lip6.fr> wrote:
> for_each_child_of_node performs an of_node_get on each iteration, so
> a break out of the loop requires an of_node_put.
>
> A simplified version of the semantic patch that fixes this problem is as
> follows (http://coccinelle.lip6.fr):
>
> // <smpl>
> @@
> expression root,e;
> local idexpression child;
> @@
>
>  for_each_child_of_node(root, child) {
>    ... when != of_node_put(child)
>        when != e = child
> (
>    return child;
> |
> +  of_node_put(child);
> ?  return ...;
> )
>    ...
>  }
> // </smpl>
>
> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>

Acked-by: Chen-Yu Tsai <wens@csie.org>

^ permalink raw reply	[flat|nested] 23+ messages in thread

* Re: [PATCH 2/4] mtd: nand: sunxi: add missing of_node_put
  2015-11-18 22:04   ` [PATCH 2/4] mtd: nand: sunxi: add missing of_node_put Julia Lawall
  2015-11-23  7:26     ` Chen-Yu Tsai
@ 2015-11-23 13:59     ` Boris Brezillon
  2015-12-01  1:56     ` Brian Norris
  2 siblings, 0 replies; 23+ messages in thread
From: Boris Brezillon @ 2015-11-23 13:59 UTC (permalink / raw)
  To: linux-arm-kernel

On Wed, 18 Nov 2015 23:04:12 +0100
Julia Lawall <Julia.Lawall@lip6.fr> wrote:

> for_each_child_of_node performs an of_node_get on each iteration, so
> a break out of the loop requires an of_node_put.
> 
> A simplified version of the semantic patch that fixes this problem is as
> follows (http://coccinelle.lip6.fr):
> 
> // <smpl>
> @@
> expression root,e;
> local idexpression child;
> @@
> 
>  for_each_child_of_node(root, child) {
>    ... when != of_node_put(child)
>        when != e = child
> (
>    return child;
> |
> +  of_node_put(child);
> ?  return ...;
> )
>    ...
>  }
> // </smpl>
> 
> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>

Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>

Thanks,

Boris

-- 
Boris Brezillon, Free Electrons
Embedded Linux and Kernel engineering
http://free-electrons.com

^ permalink raw reply	[flat|nested] 23+ messages in thread

* Re: [PATCH 1/4 v2] mtd: brcmnand: improve memory management
  2015-11-19 21:32           ` [PATCH 1/4 v2] " Julia Lawall
@ 2015-12-01  1:56             ` Brian Norris
  0 siblings, 0 replies; 23+ messages in thread
From: Brian Norris @ 2015-12-01  1:56 UTC (permalink / raw)
  To: Julia Lawall
  Cc: kernel-janitors, David Woodhouse, linux-mtd,
	bcm-kernel-feedback-list, linux-kernel, Russell King - ARM Linux,
	Thomas Petazzoni, Andrew Lunn, Bjorn Helgaas, Jason Cooper,
	Kamal Dasu

On Thu, Nov 19, 2015 at 10:32:15PM +0100, Julia Lawall wrote:
> This patch addresses two related memory management issues in the probe
> function:
> 
> 1. for_each_available_child_of_node performs an of_node_get on each
> iteration, so a break out of the loop requires an of_node_put.
> 
> A simplified version of the semantic patch that fixes this problem is as
> follows (http://coccinelle.lip6.fr):
> 
> // <smpl>
> @@
> expression root,e;
> local idexpression child;
> @@
> 
>  for_each_available_child_of_node(root, child) {
>    ... when != of_node_put(child)
>        when != e = child
> (
>    return child;
> |
> +  of_node_put(child);
> ?  return ...;
> )
>    ...
>  }
> // </smpl>
> 
> 2. The devm_kzalloc'd data is not used if brcmnand_init_cs fails.  Free it
> immediately, using devm_kfree in this case, instead of waiting for the
> remove function.
> 
> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
> 
> ---
> 
> v2: Drop of_node_get addition, as another patch will get rid of the need
> for it completely.

Pushed to l2-mtd.git

^ permalink raw reply	[flat|nested] 23+ messages in thread

* Re: [PATCH 2/4] mtd: nand: sunxi: add missing of_node_put
  2015-11-18 22:04   ` [PATCH 2/4] mtd: nand: sunxi: add missing of_node_put Julia Lawall
  2015-11-23  7:26     ` Chen-Yu Tsai
  2015-11-23 13:59     ` Boris Brezillon
@ 2015-12-01  1:56     ` Brian Norris
  2 siblings, 0 replies; 23+ messages in thread
From: Brian Norris @ 2015-12-01  1:56 UTC (permalink / raw)
  To: linux-arm-kernel

On Wed, Nov 18, 2015 at 11:04:12PM +0100, Julia Lawall wrote:
> for_each_child_of_node performs an of_node_get on each iteration, so
> a break out of the loop requires an of_node_put.
> 
> A simplified version of the semantic patch that fixes this problem is as
> follows (http://coccinelle.lip6.fr):
> 
> // <smpl>
> @@
> expression root,e;
> local idexpression child;
> @@
> 
>  for_each_child_of_node(root, child) {
>    ... when != of_node_put(child)
>        when != e = child
> (
>    return child;
> |
> +  of_node_put(child);
> ?  return ...;
> )
>    ...
>  }
> // </smpl>
> 
> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
> 

Pushed to l2-mtd.git

^ permalink raw reply	[flat|nested] 23+ messages in thread

* Re: [PATCH 4/4] power/reset: at91-reset: add missing of_node_put
  2015-11-18 22:04   ` [PATCH 4/4] power/reset: at91-reset: " Julia Lawall
@ 2015-12-05  0:42     ` Sebastian Reichel
  0 siblings, 0 replies; 23+ messages in thread
From: Sebastian Reichel @ 2015-12-05  0:42 UTC (permalink / raw)
  To: Julia Lawall
  Cc: kernel-janitors, Dmitry Eremin-Solenikov, David Woodhouse,
	linux-pm, linux-kernel, Russell King - ARM Linux,
	Thomas Petazzoni, Andrew Lunn, Bjorn Helgaas, Jason Cooper

[-- Attachment #1: Type: text/plain, Size: 685 bytes --]

Hi,

On Wed, Nov 18, 2015 at 11:04:14PM +0100, Julia Lawall wrote:
> for_each_matching_node performs an of_node_get on each iteration, so
> a break out of the loop requires an of_node_put.
> 
> A simplified version of the semantic patch that fixes this problem is as
> follows (http://coccinelle.lip6.fr):
> 
> // <smpl>
> @@
> expression e,e1;
> local idexpression np;
> @@
> 
>  for_each_matching_node(np, e1) {
>    ... when != of_node_put(np)
>        when != e = np
> (
>    return np;
> |
> +  of_node_put(np);
> ?  return ...;
> )
>    ...
>  }
> // </smpl>
> 
> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>

Thanks, queued.

-- Sebastian

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

^ permalink raw reply	[flat|nested] 23+ messages in thread

end of thread, other threads:[~2015-12-05  0:42 UTC | newest]

Thread overview: 23+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-10-22  9:02 [PATCH 0/4] add missing of_node_put Julia Lawall
2015-10-22  9:02 ` [PATCH 1/4] of/overlay: " Julia Lawall
2015-10-22  9:02 ` [PATCH 2/4] of/platform: " Julia Lawall
     [not found] ` <1445504571-19838-1-git-send-email-Julia.Lawall-L2FTfq7BK8M@public.gmane.org>
2015-10-22  9:02   ` [PATCH 3/4] of/unittest: " Julia Lawall
2015-10-22  9:02 ` [PATCH 4/4] of/irq: " Julia Lawall
2015-10-22 13:04 ` [PATCH 0/4] " Rob Herring
     [not found]   ` <CAL_JsqJGS+L=FZAwPs-wBSYiX8kQWqZyaLTGhadYVNT3=Qte_Q-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2015-10-22 13:19     ` Julia Lawall
2015-10-22 15:08 ` Rob Herring
2015-11-18 22:04 ` Julia Lawall
2015-11-18 22:04   ` [PATCH 1/4] mtd: brcmnand: improve memory management Julia Lawall
2015-11-18 22:44     ` Brian Norris
2015-11-19  6:13       ` Julia Lawall
2015-11-19 19:26         ` Brian Norris
2015-11-19 21:32           ` [PATCH 1/4 v2] " Julia Lawall
2015-12-01  1:56             ` Brian Norris
2015-11-18 22:04   ` [PATCH 2/4] mtd: nand: sunxi: add missing of_node_put Julia Lawall
2015-11-23  7:26     ` Chen-Yu Tsai
2015-11-23 13:59     ` Boris Brezillon
2015-12-01  1:56     ` Brian Norris
2015-11-18 22:04   ` [PATCH 3/4] iio: adc: spmi-vadc: " Julia Lawall
2015-11-21 18:25     ` Jonathan Cameron
2015-11-18 22:04   ` [PATCH 4/4] power/reset: at91-reset: " Julia Lawall
2015-12-05  0:42     ` Sebastian Reichel

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).