[PATCH 1/2] pci: rpadlpar: fix leaked device_node references in add/remove paths

[PATCH 1/2] pci: rpadlpar: fix leaked device_node references in add/remove paths

[Tyrel Datwyler]

The find_dlpar_node() helper returns a device node with its reference
incremented. Both the add and remove paths use this helper for find the
appropriate node, but fail to release the reference when done.

Annotate the find_dlpar_node() helper with a comment about the incremented
reference count, and call of_node_put() on the obtained device_node in the
add and remove paths. Also, fixup a reference leak in the find_vio_slot()
helper where we fail to call of_node_put() on the vdevice node after we
iterate over its children.

Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
---
 drivers/pci/hotplug/rpadlpar_core.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/pci/hotplug/rpadlpar_core.c b/drivers/pci/hotplug/rpadlpar_core.c
index e2356a9c7088..182f9e3443ee 100644
--- a/drivers/pci/hotplug/rpadlpar_core.c
+++ b/drivers/pci/hotplug/rpadlpar_core.c
@@ -51,6 +51,7 @@ static struct device_node *find_vio_slot_node(char *drc_name)
 		if (rc == 0)
 			break;
 	}
+	of_node_put(parent);
 
 	return dn;
 }
@@ -71,6 +72,7 @@ static struct device_node *find_php_slot_pci_node(char *drc_name,
 	return np;
 }
 
+/* Returns a device_node with its reference count incremented */
 static struct device_node *find_dlpar_node(char *drc_name, int *node_type)
 {
 	struct device_node *dn;
@@ -306,6 +308,7 @@ int dlpar_add_slot(char *drc_name)
 			rc = dlpar_add_phb(drc_name, dn);
 			break;
 	}
+	of_node_put(dn);
 
 	printk(KERN_INFO "%s: slot %s added\n", DLPAR_MODULE_NAME, drc_name);
 exit:
@@ -439,6 +442,7 @@ int dlpar_remove_slot(char *drc_name)
 			rc = dlpar_remove_pci_slot(drc_name, dn);
 			break;
 	}
+	of_node_put(dn);
 	vm_unmap_aliases();
 
 	printk(KERN_INFO "%s: slot %s removed\n", DLPAR_MODULE_NAME, drc_name);
-- 
2.12.3

[PATCH 2/2] pci: rpaphp: get/put device node reference during slot alloc/dealloc

[Tyrel Datwyler]

When allocating the slot structure we store a pointer to the associated
device_node. We really should be incrementing the reference count, so
add an of_node_get() during slot alloc and an of_node_put() during slot
dealloc.

Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
---
 drivers/pci/hotplug/rpaphp_slot.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/pci/hotplug/rpaphp_slot.c b/drivers/pci/hotplug/rpaphp_slot.c
index 5282aa3e33c5..93b4a945c55d 100644
--- a/drivers/pci/hotplug/rpaphp_slot.c
+++ b/drivers/pci/hotplug/rpaphp_slot.c
@@ -21,6 +21,7 @@
 /* free up the memory used by a slot */
 void dealloc_slot_struct(struct slot *slot)
 {
+	of_node_put(slot->dn);
 	kfree(slot->name);
 	kfree(slot);
 }
@@ -36,7 +37,7 @@ struct slot *alloc_slot_struct(struct device_node *dn,
 	slot->name = kstrdup(drc_name, GFP_KERNEL);
 	if (!slot->name)
 		goto error_slot;
-	slot->dn = dn;
+	slot->dn = of_node_get(dn);
 	slot->index = drc_index;
 	slot->power_domain = power_domain;
 	slot->hotplug_slot.ops = &rpaphp_hotplug_slot_ops;
-- 
2.12.3

Re: [PATCH 1/2] pci: rpadlpar: fix leaked device_node references in add/remove paths

[Bjorn Helgaas]

On Fri, Mar 22, 2019 at 01:27:21PM -0500, Tyrel Datwyler wrote:
> The find_dlpar_node() helper returns a device node with its reference
> incremented. Both the add and remove paths use this helper for find the
> appropriate node, but fail to release the reference when done.
> 
> Annotate the find_dlpar_node() helper with a comment about the incremented
> reference count, and call of_node_put() on the obtained device_node in the
> add and remove paths. Also, fixup a reference leak in the find_vio_slot()
> helper where we fail to call of_node_put() on the vdevice node after we
> iterate over its children.
> 
> Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>

Both applied to pci/hotplug for v5.2, thanks!

> ---
>  drivers/pci/hotplug/rpadlpar_core.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/pci/hotplug/rpadlpar_core.c b/drivers/pci/hotplug/rpadlpar_core.c
> index e2356a9c7088..182f9e3443ee 100644
> --- a/drivers/pci/hotplug/rpadlpar_core.c
> +++ b/drivers/pci/hotplug/rpadlpar_core.c
> @@ -51,6 +51,7 @@ static struct device_node *find_vio_slot_node(char *drc_name)
>  		if (rc == 0)
>  			break;
>  	}
> +	of_node_put(parent);
>  
>  	return dn;
>  }
> @@ -71,6 +72,7 @@ static struct device_node *find_php_slot_pci_node(char *drc_name,
>  	return np;
>  }
>  
> +/* Returns a device_node with its reference count incremented */
>  static struct device_node *find_dlpar_node(char *drc_name, int *node_type)
>  {
>  	struct device_node *dn;
> @@ -306,6 +308,7 @@ int dlpar_add_slot(char *drc_name)
>  			rc = dlpar_add_phb(drc_name, dn);
>  			break;
>  	}
> +	of_node_put(dn);
>  
>  	printk(KERN_INFO "%s: slot %s added\n", DLPAR_MODULE_NAME, drc_name);
>  exit:
> @@ -439,6 +442,7 @@ int dlpar_remove_slot(char *drc_name)
>  			rc = dlpar_remove_pci_slot(drc_name, dn);
>  			break;
>  	}
> +	of_node_put(dn);
>  	vm_unmap_aliases();
>  
>  	printk(KERN_INFO "%s: slot %s removed\n", DLPAR_MODULE_NAME, drc_name);
> -- 
> 2.12.3
>