[PATCH 0/4] add missing of_node_put

[PATCH 0/4] add missing of_node_put

[Julia Lawall]

The various for_each device_node iterators performs an of_node_get on each
iteration, so a break out of the loop requires an of_node_put.

The complete semantic patch that fixes this problem is
(http://coccinelle.lip6.fr):

// <smpl>
@r@
local idexpression n;
expression e1,e2;
iterator name for_each_node_by_name, for_each_node_by_type,
for_each_compatible_node, for_each_matching_node,
for_each_matching_node_and_match, for_each_child_of_node,
for_each_available_child_of_node, for_each_node_with_property;
iterator i;
statement S;
expression list [n1] es;
@@

(
(
for_each_node_by_name(n,e1) S
|
for_each_node_by_type(n,e1) S
|
for_each_compatible_node(n,e1,e2) S
|
for_each_matching_node(n,e1) S
|
for_each_matching_node_and_match(n,e1,e2) S
|
for_each_child_of_node(e1,n) S
|
for_each_available_child_of_node(e1,n) S
|
for_each_node_with_property(n,e1) S
)
&
i(es,n,...) S
)

@@
local idexpression r.n;
iterator r.i;
expression e;
expression list [r.n1] es;
@@

 i(es,n,...) {
   ...
(
   of_node_put(n);
|
   e = n
|
   return n;
|
+  of_node_put(n);
?  return ...;
)
   ...
 }

@@
local idexpression r.n;
iterator r.i;
expression e;
expression list [r.n1] es;
@@

 i(es,n,...) {
   ...
(
   of_node_put(n);
|
   e = n
|
+  of_node_put(n);
?  break;
)
   ...
 }
... when != n

@@
local idexpression r.n;
iterator r.i;
expression e;
identifier l;
expression list [r.n1] es;
@@

 i(es,n,...) {
   ...
(
   of_node_put(n);
|
   e = n
|
+  of_node_put(n);
?  goto l;
)
   ...
 }
...
l: ... when != n// </smpl>

---

 drivers/of/irq.c      |    7 +++++--
 drivers/of/overlay.c  |    5 ++++-
 drivers/of/platform.c |    8 ++++++--
 drivers/of/unittest.c |    8 ++++++--
 4 files changed, 21 insertions(+), 7 deletions(-)

[PATCH 1/4] of/overlay: add missing of_node_put

[Julia Lawall]

for_each_child_of_node performs an of_node_get on each iteration, so
a break out of the loop requires an of_node_put.

A simplified version of the semantic patch that fixes this problem is as
follows (http://coccinelle.lip6.fr):

// <smpl>
@@
expression root,e;
local idexpression child;
@@

 for_each_child_of_node(root, child) {
   ... when != of_node_put(child)
       when != e = child
(
   return child;
|
+  of_node_put(child);
?  return ...;
)
   ...
 }
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>

---
 drivers/of/overlay.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
index 24e025f..54e5af9 100644
--- a/drivers/of/overlay.c
+++ b/drivers/of/overlay.c
@@ -149,6 +149,7 @@ static int of_overlay_apply_one(struct of_overlay *ov,
 			pr_err("%s: Failed to apply single node @%s/%s\n",
 					__func__, target->full_name,
 					child->name);
+			of_node_put(child);
 			return ret;
 		}
 	}
@@ -417,8 +418,10 @@ static int overlay_subtree_check(struct device_node *tree,
 		return 1;
 
 	for_each_child_of_node(tree, child) {
-		if (overlay_subtree_check(child, dn))
+		if (overlay_subtree_check(child, dn)) {
+			of_node_put(child);
 			return 1;
+		}
 	}
 
 	return 0;

[PATCH 2/4] of/platform: add missing of_node_put

[Julia Lawall]

for_each_child_of_node performs an of_node_get on each iteration, so
a break out of the loop requires an of_node_put.

A simplified version of the semantic patch that fixes this problem is as
follows (http://coccinelle.lip6.fr):

// <smpl>
@@
local idexpression n;
expression root,e;
@@

 for_each_child_of_node(root,n) {
   ...
(
   of_node_put(n);
|
   e = n
|
+  of_node_put(n);
?  break;
)
   ...
 }
... when != n
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>

---
 drivers/of/platform.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 7b33e03..64daf05 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -409,8 +409,10 @@ int of_platform_bus_probe(struct device_node *root,
 		if (!of_match_node(matches, child))
 			continue;
 		rc = of_platform_bus_create(child, matches, NULL, parent, false);
-		if (rc)
+		if (rc) {
+			of_node_put(child);
 			break;
+		}
 	}
 
 	of_node_put(root);
@@ -451,8 +453,10 @@ int of_platform_populate(struct device_node *root,
 
 	for_each_child_of_node(root, child) {
 		rc = of_platform_bus_create(child, matches, lookup, parent, true);
-		if (rc)
+		if (rc) {
+			of_node_put(child);
 			break;
+		}
 	}
 	of_node_set_flag(root, OF_POPULATED_BUS);
 

[PATCH 3/4] of/unittest: add missing of_node_put

[Julia Lawall]

for_each_child_of_node performs an of_node_get on each iteration, so
a break out of the loop requires an of_node_put.

A simplified version of the semantic patch that fixes this problem is as
follows (http://coccinelle.lip6.fr):

// <smpl>
@@
expression root,e;
local idexpression child;
@@

 for_each_child_of_node(root, child) {
   ... when != of_node_put(child)
       when != e = child
(
   return child;
|
+  of_node_put(child);
?  return ...;
)
   ...
 }
// </smpl>

Combine the puts into code at the end of the function, for conciseness.

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>

---
 drivers/of/unittest.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
index 9f71770..e16ea57 100644
--- a/drivers/of/unittest.c
+++ b/drivers/of/unittest.c
@@ -205,16 +205,20 @@ static int __init of_unittest_check_node_linkage(struct device_node *np)
 		if (child->parent != np) {
 			pr_err("Child node %s links to wrong parent %s\n",
 				 child->name, np->name);
-			return -EINVAL;
+			rc = -EINVAL;
+			goto put_child;
 		}
 
 		rc = of_unittest_check_node_linkage(child);
 		if (rc < 0)
-			return rc;
+			goto put_child;
 		count += rc;
 	}
 
 	return count + 1;
+put_child:
+	of_node_put(child);
+	return rc;
 }
 
 static void __init of_unittest_check_tree_linkage(void)

[PATCH 4/4] of/irq: add missing of_node_put

[Julia Lawall]

for_each_matching_node performs an of_node_get on each iteration, so
a break out of the loop requires an of_node_put.

A simplified version of the semantic patch that fixes this problem is as
follows (http://coccinelle.lip6.fr):

// <smpl>
@@
local idexpression n;
expression e;
identifier l;
@@

 for_each_matching_node(n,...) {
   ...
(
   of_node_put(n);
|
   e = n
|
+  of_node_put(n);
?  goto l;
)
   ...
 }
...
l: ... when != n
// </smpl>

Besides the issue found by the semantic patch, this code also stores the
device_node value in a list, which requires an of_node_get, and then cleans
up the list on exit from the function, which requires an of_node_put.

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>

---
 drivers/of/irq.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 171798d..902b89b 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -501,10 +501,12 @@ void __init of_irq_init(const struct of_device_id *matches)
 		 * pointer, interrupt-parent device_node etc.
 		 */
 		desc = kzalloc(sizeof(*desc), GFP_KERNEL);
-		if (WARN_ON(!desc))
+		if (WARN_ON(!desc)) {
+			of_node_put(np);
 			goto err;
+		}
 
-		desc->dev = np;
+		desc->dev = of_node_get(np);
 		desc->interrupt_parent = of_irq_find_parent(np);
 		if (desc->interrupt_parent == np)
 			desc->interrupt_parent = NULL;
@@ -575,6 +577,7 @@ void __init of_irq_init(const struct of_device_id *matches)
 err:
 	list_for_each_entry_safe(desc, temp_desc, &intc_desc_list, list) {
 		list_del(&desc->list);
+		of_node_put(desc->dev);
 		kfree(desc);
 	}
 }

Re: [PATCH 0/4] add missing of_node_put

[Rob Herring]

+Russell who raised issues with these iterators recently.

On Thu, Oct 22, 2015 at 4:02 AM, Julia Lawall <Julia.Lawall@lip6.fr> wrote:
> The various for_each device_node iterators performs an of_node_get on each
> iteration, so a break out of the loop requires an of_node_put.

Thanks for this.

Are there any plans to use coccinelle as a checker that developers can
run to be warned of these problems?

Rob

> The complete semantic patch that fixes this problem is
> (http://coccinelle.lip6.fr):
>
> // <smpl>
> @r@
> local idexpression n;
> expression e1,e2;
> iterator name for_each_node_by_name, for_each_node_by_type,
> for_each_compatible_node, for_each_matching_node,
> for_each_matching_node_and_match, for_each_child_of_node,
> for_each_available_child_of_node, for_each_node_with_property;
> iterator i;
> statement S;
> expression list [n1] es;
> @@
>
> (
> (
> for_each_node_by_name(n,e1) S
> |
> for_each_node_by_type(n,e1) S
> |
> for_each_compatible_node(n,e1,e2) S
> |
> for_each_matching_node(n,e1) S
> |
> for_each_matching_node_and_match(n,e1,e2) S
> |
> for_each_child_of_node(e1,n) S
> |
> for_each_available_child_of_node(e1,n) S
> |
> for_each_node_with_property(n,e1) S
> )
> &
> i(es,n,...) S
> )
>
> @@
> local idexpression r.n;
> iterator r.i;
> expression e;
> expression list [r.n1] es;
> @@
>
>  i(es,n,...) {
>    ...
> (
>    of_node_put(n);
> |
>    e = n
> |
>    return n;
> |
> +  of_node_put(n);
> ?  return ...;
> )
>    ...
>  }
>
> @@
> local idexpression r.n;
> iterator r.i;
> expression e;
> expression list [r.n1] es;
> @@
>
>  i(es,n,...) {
>    ...
> (
>    of_node_put(n);
> |
>    e = n
> |
> +  of_node_put(n);
> ?  break;
> )
>    ...
>  }
> ... when != n
>
> @@
> local idexpression r.n;
> iterator r.i;
> expression e;
> identifier l;
> expression list [r.n1] es;
> @@
>
>  i(es,n,...) {
>    ...
> (
>    of_node_put(n);
> |
>    e = n
> |
> +  of_node_put(n);
> ?  goto l;
> )
>    ...
>  }
> ...
> l: ... when != n// </smpl>
>
> ---
>
>  drivers/of/irq.c      |    7 +++++--
>  drivers/of/overlay.c  |    5 ++++-
>  drivers/of/platform.c |    8 ++++++--
>  drivers/of/unittest.c |    8 ++++++--
>  4 files changed, 21 insertions(+), 7 deletions(-)

Re: [PATCH 0/4] add missing of_node_put

[Julia Lawall]

On Thu, 22 Oct 2015, Rob Herring wrote:

> +Russell who raised issues with these iterators recently.
>
> On Thu, Oct 22, 2015 at 4:02 AM, Julia Lawall <Julia.Lawall@lip6.fr> wrote:
> > The various for_each device_node iterators performs an of_node_get on each
> > iteration, so a break out of the loop requires an of_node_put.
>
> Thanks for this.
>
> Are there any plans to use coccinelle as a checker that developers can
> run to be warned of these problems?

There are three issues I have found so far:

1.  of_node_put before a continue
2.  missing of_node_put before a break
3.  missing of_node get before some more permanent storage of the value

The semantic patches for the first two seem to be working pretty well, so
I could submit them for integration into the kernel.  The third one, I
have only looked at in an ad hoc way so far.

julia

>
> Rob
>
> > The complete semantic patch that fixes this problem is
> > (http://coccinelle.lip6.fr):
> >
> > // <smpl>
> > @r@
> > local idexpression n;
> > expression e1,e2;
> > iterator name for_each_node_by_name, for_each_node_by_type,
> > for_each_compatible_node, for_each_matching_node,
> > for_each_matching_node_and_match, for_each_child_of_node,
> > for_each_available_child_of_node, for_each_node_with_property;
> > iterator i;
> > statement S;
> > expression list [n1] es;
> > @@
> >
> > (
> > (
> > for_each_node_by_name(n,e1) S
> > |
> > for_each_node_by_type(n,e1) S
> > |
> > for_each_compatible_node(n,e1,e2) S
> > |
> > for_each_matching_node(n,e1) S
> > |
> > for_each_matching_node_and_match(n,e1,e2) S
> > |
> > for_each_child_of_node(e1,n) S
> > |
> > for_each_available_child_of_node(e1,n) S
> > |
> > for_each_node_with_property(n,e1) S
> > )
> > &
> > i(es,n,...) S
> > )
> >
> > @@
> > local idexpression r.n;
> > iterator r.i;
> > expression e;
> > expression list [r.n1] es;
> > @@
> >
> >  i(es,n,...) {
> >    ...
> > (
> >    of_node_put(n);
> > |
> >    e = n
> > |
> >    return n;
> > |
> > +  of_node_put(n);
> > ?  return ...;
> > )
> >    ...
> >  }
> >
> > @@
> > local idexpression r.n;
> > iterator r.i;
> > expression e;
> > expression list [r.n1] es;
> > @@
> >
> >  i(es,n,...) {
> >    ...
> > (
> >    of_node_put(n);
> > |
> >    e = n
> > |
> > +  of_node_put(n);
> > ?  break;
> > )
> >    ...
> >  }
> > ... when != n
> >
> > @@
> > local idexpression r.n;
> > iterator r.i;
> > expression e;
> > identifier l;
> > expression list [r.n1] es;
> > @@
> >
> >  i(es,n,...) {
> >    ...
> > (
> >    of_node_put(n);
> > |
> >    e = n
> > |
> > +  of_node_put(n);
> > ?  goto l;
> > )
> >    ...
> >  }
> > ...
> > l: ... when != n// </smpl>
> >
> > ---
> >
> >  drivers/of/irq.c      |    7 +++++--
> >  drivers/of/overlay.c  |    5 ++++-
> >  drivers/of/platform.c |    8 ++++++--
> >  drivers/of/unittest.c |    8 ++++++--
> >  4 files changed, 21 insertions(+), 7 deletions(-)
> --
> To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>

Re: [PATCH 0/4] add missing of_node_put

[Rob Herring]

On Thu, Oct 22, 2015 at 4:02 AM, Julia Lawall <Julia.Lawall@lip6.fr> wrote:
> The various for_each device_node iterators performs an of_node_get on each
> iteration, so a break out of the loop requires an of_node_put.

> ---
>
>  drivers/of/irq.c      |    7 +++++--
>  drivers/of/overlay.c  |    5 ++++-
>  drivers/of/platform.c |    8 ++++++--
>  drivers/of/unittest.c |    8 ++++++--
>  4 files changed, 21 insertions(+), 7 deletions(-)

Series applied, thanks.

Rob