archive mirror
 help / color / mirror / Atom feed
To: Rob Herring <>,
	Pantelis Antoniou <>,
	Michael Ellerman <>,
	Benjamin Herrenschmidt <>,
	Paul Mackerras <>, Alan Tull <>,
	Moritz Fischer <>
Subject: [PATCH v7 02/17] of: overlay: add missing of_node_put() after add new node to changeset
Date: Thu,  8 Nov 2018 22:05:50 -0800	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

From: Frank Rowand <>

The refcount of a newly added overlay node decrements to one
(instead of zero) when the overlay changeset is destroyed.  This
change will cause the final decrement be to zero.

After applying this patch, new validation warnings will be
reported from the devicetree unittest during boot due to
a pre-existing devicetree bug.  The warnings will be similar to:

  OF: ERROR: memory leak before free overlay changeset,  /testcase-data/overlay-node/test-bus/test-unittest4

This pre-existing devicetree bug will also trigger a WARN_ONCE() from
refcount_sub_and_test_checked() when an overlay changeset is
destroyed without having first been applied.  This scenario occurs
when an error in the overlay is detected during the overlay changeset

  WARNING: CPU: 0 PID: 1 at lib/refcount.c:187 refcount_sub_and_test_checked+0xa8/0xbc
  refcount_t: underflow; use-after-free.

  (unwind_backtrace) from (show_stack+0x10/0x14)
  (show_stack) from (dump_stack+0x6c/0x8c)
  (dump_stack) from (__warn+0xdc/0x104)
  (__warn) from (warn_slowpath_fmt+0x44/0x6c)
  (warn_slowpath_fmt) from (refcount_sub_and_test_checked+0xa8/0xbc)
  (refcount_sub_and_test_checked) from (kobject_put+0x24/0x208)
  (kobject_put) from (of_changeset_destroy+0x2c/0xb4)
  (of_changeset_destroy) from (free_overlay_changeset+0x1c/0x9c)
  (free_overlay_changeset) from (of_overlay_remove+0x284/0x2cc)
  (of_overlay_remove) from (of_unittest_apply_revert_overlay_check.constprop.4+0xf8/0x1e8)
  (of_unittest_apply_revert_overlay_check.constprop.4) from (of_unittest_overlay+0x960/0xed8)
  (of_unittest_overlay) from (of_unittest+0x1cc4/0x2138)
  (of_unittest) from (do_one_initcall+0x4c/0x28c)
  (do_one_initcall) from (kernel_init_freeable+0x29c/0x378)
  (kernel_init_freeable) from (kernel_init+0x8/0x110)
  (kernel_init) from (ret_from_fork+0x14/0x2c)

Tested-by: Alan Tull <>
Signed-off-by: Frank Rowand <>
 drivers/of/overlay.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
index f5fc8859a7ee..7613f7d680c7 100644
--- a/drivers/of/overlay.c
+++ b/drivers/of/overlay.c
@@ -379,7 +379,9 @@ static int add_changeset_node(struct overlay_changeset *ovcs,
 		if (ret)
 			return ret;
-		return build_changeset_next_level(ovcs, tchild, node);
+		ret = build_changeset_next_level(ovcs, tchild, node);
+		of_node_put(tchild);
+		return ret;
 	if (node->phandle && tchild->phandle)
Frank Rowand <>

  parent reply	other threads:[~2018-11-09  6:07 UTC|newest]

Thread overview: 18+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-11-09  6:05 [PATCH v7 00/17] of: overlay: validation checks, subsequent fixes frowand.list
2018-11-09  6:05 ` [PATCH v7 01/17] of: overlay: add tests to validate kfrees from overlay removal frowand.list
2018-11-09  6:05 ` frowand.list [this message]
2018-11-09  6:05 ` [PATCH v7 03/17] of: overlay: add missing of_node_get() in __of_attach_node_sysfs frowand.list
2018-11-09  6:05 ` [PATCH v7 04/17] powerpc/pseries: add of_node_put() in dlpar_detach_node() frowand.list
2018-11-09  6:05 ` [PATCH v7 05/17] of: overlay: use prop add changeset entry for property in new nodes frowand.list
2018-11-09  6:05 ` [PATCH v7 06/17] of: overlay: do not duplicate properties from overlay for " frowand.list
2018-11-09  6:05 ` [PATCH v7 07/17] of: overlay: reorder fields in struct fragment frowand.list
2018-11-09  6:05 ` [PATCH v7 08/17] of: overlay: validate overlay properties #address-cells and #size-cells frowand.list
2018-11-09  6:05 ` [PATCH v7 09/17] of: overlay: make all pr_debug() and pr_err() messages unique frowand.list
2018-11-09  6:05 ` [PATCH v7 10/17] of: overlay: test case of two fragments adding same node frowand.list
2018-11-09  6:05 ` [PATCH v7 11/17] of: overlay: check prevents multiple fragments add or delete " frowand.list
2018-11-09  6:06 ` [PATCH v7 12/17] of: overlay: check prevents multiple fragments touching same property frowand.list
2018-11-09  6:06 ` [PATCH v7 13/17] of: unittest: remove unused of_unittest_apply_overlay() argument frowand.list
2018-11-09  6:06 ` [PATCH v7 14/17] of: overlay: set node fields from properties when add new overlay node frowand.list
2018-11-09  6:06 ` [PATCH v7 15/17] of: unittest: allow base devicetree to have symbol metadata frowand.list
2018-11-09  6:06 ` [PATCH v7 16/17] of: unittest: find overlays[] entry by name instead of index frowand.list
2018-11-09  6:06 ` [PATCH v7 17/17] of: unittest: initialize args before calling of_*parse_*() frowand.list

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \ \ \ \ \ \
    --subject='Re: [PATCH v7 02/17] of: overlay: add missing of_node_put() after add new node to changeset' \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).