[PATCH 4.19 21/72] ARM: imx51: fix a leaked reference by adding missing of_node_put

[PATCH 4.19 21/72] ARM: imx51: fix a leaked reference by adding missing of_node_put

[Greg Kroah-Hartman]

[ Upstream commit 0c17e83fe423467e3ccf0a02f99bd050a73bbeb4 ]

The call to of_get_next_child returns a node pointer with refcount
incremented thus it must be explicitly decremented after the last
usage.

Detected by coccinelle with the following warnings:
./arch/arm/mach-imx/mach-imx51.c:64:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 57, but without a corresponding object release within this function.

Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
Cc: Russell King <linux@armlinux.org.uk>
Cc: Shawn Guo <shawnguo@kernel.org>
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Cc: Pengutronix Kernel Team <kernel@pengutronix.de>
Cc: Fabio Estevam <festevam@gmail.com>
Cc: NXP Linux Team <linux-imx@nxp.com>
Cc: Lucas Stach <l.stach@pengutronix.de>
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin (Microsoft) <sashal@kernel.org>
---
 arch/arm/mach-imx/mach-imx51.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/mach-imx/mach-imx51.c b/arch/arm/mach-imx/mach-imx51.c
index c7169c2f94c4..08c7892866c2 100644
--- a/arch/arm/mach-imx/mach-imx51.c
+++ b/arch/arm/mach-imx/mach-imx51.c
@@ -59,6 +59,7 @@ static void __init imx51_m4if_setup(void)
 		return;
 
 	m4if_base = of_iomap(np, 0);
+	of_node_put(np);
 	if (!m4if_base) {
 		pr_err("Unable to map M4IF registers\n");
 		return;
-- 
2.19.1




_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH 4.19 46/72] net: xilinx: fix possible object reference leak

[Greg Kroah-Hartman]

[ Upstream commit fa3a419d2f674b431d38748cb58fb7da17ee8949 ]

The call to of_parse_phandle returns a node pointer with refcount
incremented thus it must be explicitly decremented after the last
usage.

Detected by coccinelle with the following warnings:
./drivers/net/ethernet/xilinx/xilinx_axienet_main.c:1624:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 1569, but without a corresponding object release within this function.

Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
Cc: Anirudha Sarangi <anirudh@xilinx.com>
Cc: John Linn <John.Linn@xilinx.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Michal Simek <michal.simek@xilinx.com>
Cc: netdev@vger.kernel.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin (Microsoft) <sashal@kernel.org>
---
 drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index f24f48f33802..7cfd7ff38e86 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -1574,12 +1574,14 @@ static int axienet_probe(struct platform_device *pdev)
 	ret = of_address_to_resource(np, 0, &dmares);
 	if (ret) {
 		dev_err(&pdev->dev, "unable to get DMA resource\n");
+		of_node_put(np);
 		goto free_netdev;
 	}
 	lp->dma_regs = devm_ioremap_resource(&pdev->dev, &dmares);
 	if (IS_ERR(lp->dma_regs)) {
 		dev_err(&pdev->dev, "could not map DMA regs\n");
 		ret = PTR_ERR(lp->dma_regs);
+		of_node_put(np);
 		goto free_netdev;
 	}
 	lp->rx_irq = irq_of_parse_and_map(np, 1);
-- 
2.19.1




_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH 4.19 46/72] net: xilinx: fix possible object reference leak

[Pavel Machek]

[-- Attachment #1.1: Type: text/plain, Size: 3519 bytes --]

On Thu 2019-05-02 17:21:08, Greg Kroah-Hartman wrote:
> [ Upstream commit fa3a419d2f674b431d38748cb58fb7da17ee8949 ]
> 
> The call to of_parse_phandle returns a node pointer with refcount
> incremented thus it must be explicitly decremented after the last
> usage.
> 
> Detected by coccinelle with the following warnings:
> ./drivers/net/ethernet/xilinx/xilinx_axienet_main.c:1624:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 1569, but without a corresponding object release within this function.
> 
> Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
> Cc: Anirudha Sarangi <anirudh@xilinx.com>
> Cc: John Linn <John.Linn@xilinx.com>
> Cc: "David S. Miller" <davem@davemloft.net>
> Cc: Michal Simek <michal.simek@xilinx.com>
> Cc: netdev@vger.kernel.org
> Cc: linux-arm-kernel@lists.infradead.org
> Cc: linux-kernel@vger.kernel.org
> Signed-off-by: David S. Miller <davem@davemloft.net>
> Signed-off-by: Sasha Levin (Microsoft) <sashal@kernel.org>

Bug is real, but fix is horrible. This already uses gotos for error
handling, so use them....

This fixes it up.

Plus... I do not think these "of_node_put" fixes belong in
stable. They are theoretical bugs; so we hold reference to device tree
structure. a) it is small, b) it stays in memory, anyway. This does
not fix any real problem.

								Pavel


diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index 4041c75..490d440 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -1575,15 +1575,13 @@ static int axienet_probe(struct platform_device *pdev)
 	ret = of_address_to_resource(np, 0, &dmares);
 	if (ret) {
 		dev_err(&pdev->dev, "unable to get DMA resource\n");
-		of_node_put(np);
-		goto free_netdev;
+		goto free_netdev_put;
 	}
 	lp->dma_regs = devm_ioremap_resource(&pdev->dev, &dmares);
 	if (IS_ERR(lp->dma_regs)) {
 		dev_err(&pdev->dev, "could not map DMA regs\n");
 		ret = PTR_ERR(lp->dma_regs);
-		of_node_put(np);
-		goto free_netdev;
+		goto free_netdev_put;
 	}
 	lp->rx_irq = irq_of_parse_and_map(np, 1);
 	lp->tx_irq = irq_of_parse_and_map(np, 0);
@@ -1620,6 +1618,8 @@ static int axienet_probe(struct platform_device *pdev)
 
 	return 0;
 
+free_netdev_put:
+	of_node_put(np);
 free_netdev:
 	free_netdev(ndev);
 


> ---
>  drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> index f24f48f33802..7cfd7ff38e86 100644
> --- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> +++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> @@ -1574,12 +1574,14 @@ static int axienet_probe(struct platform_device *pdev)
>  	ret = of_address_to_resource(np, 0, &dmares);
>  	if (ret) {
>  		dev_err(&pdev->dev, "unable to get DMA resource\n");
> +		of_node_put(np);
>  		goto free_netdev;
>  	}
>  	lp->dma_regs = devm_ioremap_resource(&pdev->dev, &dmares);
>  	if (IS_ERR(lp->dma_regs)) {
>  		dev_err(&pdev->dev, "could not map DMA regs\n");
>  		ret = PTR_ERR(lp->dma_regs);
> +		of_node_put(np);
>  		goto free_netdev;
>  	}
>  	lp->rx_irq = irq_of_parse_and_map(np, 1);

-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

[-- Attachment #1.2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

[-- Attachment #2: Type: text/plain, Size: 176 bytes --]

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH 4.19 46/72] net: xilinx: fix possible object referenceleak

[Pavel Machek]

[-- Attachment #1.1: Type: text/plain, Size: 2791 bytes --]

Hi!
> > > [ Upstream commit fa3a419d2f674b431d38748cb58fb7da17ee8949 ]
> > >
> > > The call to of_parse_phandle returns a node pointer with refcount
> > > incremented thus it must be explicitly decremented after the last
> > > usage.
> > >
> > > Detected by coccinelle with the following warnings:
> > > ./drivers/net/ethernet/xilinx/xilinx_axienet_main.c:1624:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 1569, but without a corresponding object release within this function.
> > 
> > Bug is real, but fix is horrible. This already uses gotos for error
> > handling, so use them....
> > 
> > This fixes it up.
> > 
> > Plus... I do not think these "of_node_put" fixes belong in
> > stable. They are theoretical bugs; so we hold reference to device tree
> > structure. a) it is small, b) it stays in memory, anyway. This does
> > not fix any real problem.
> > 
> 
> Thank you very much for your comments.
> We developed the following coccinelle SmPL to look for places where
> there is an of_node_put on some path but not on others.

I agree that the fix is good. Thanks for doing coccinelle work.

> We use it to detect drivers/net/ethernet/xilinx/xilinx_axienet_main.c and found the following issue:
> 
> static int axienet_probe(struct platform_device *pdev)
> {
> ...
>         struct device_node *np;
> ...
>         if (ret) {
>                 dev_err(&pdev->dev, "unable to get DMA resource\n");
>                 goto free_netdev;  ---> leaked here
>         }
> ...
>         if (IS_ERR(lp->dma_regs)) {
>                 dev_err(&pdev->dev, "could not map DMA regs\n");
>                 ret = PTR_ERR(lp->dma_regs);
>                 goto free_netdev; ---> leaked here
>         }
> ...
>          of_node_put(np);   --->    released here
> ...
> free_netdev:
>         free_netdev(ndev);
> 
>         return ret;
> }
> 
> If we insmod/rmmod xilinx_emaclite.ko multiple times, 
> axienet_probe() may be called multiple times, then a resource leak
> may occur.

Yeah, well. I agree the bug is real. But how much memory will it leak
during each insmod? Kilobyte? (Is it actually anything at all? I'd
expect just reference counter to be increaed.) How often do you
usually insmod?

> At the same time, we also checked the code for handling resource leaks in the current kernel
> and found that the regular of_node_put mode is commonly used in
> addition to the goto target mode.

Ok, so this uglyness happens elsewhere. But I'd really prefer to use
goto if it is already used in the function.

Thanks,

								Pavel
-- 
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

[-- Attachment #1.2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

[-- Attachment #2: Type: text/plain, Size: 176 bytes --]

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel