| Message ID | 20241216041536.485250-1-joe@pf.is.s.u-tokyo.ac.jp (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | net: mv643xx_eth: fix an OF node reference leak | expand |
Please disregard this patch as I sent a v2 patch. On 12/16/24 13:15, Joe Hattori wrote: > Current implementation of mv643xx_eth_shared_of_add_port() calls > of_parse_phandle(), but does not release the refcount on error. Call > of_node_put() in the error path and in mv643xx_eth_shared_of_remove(). > > This bug was found by an experimental static analysis tool that I am > developing. > > Fixes: 76723bca2802 ("net: mv643xx_eth: add DT parsing support") > Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp> > --- > drivers/net/ethernet/marvell/mv643xx_eth.c | 11 +++++++++-- > 1 file changed, 9 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c > index a06048719e84..fa30f8c4a0cc 100644 > --- a/drivers/net/ethernet/marvell/mv643xx_eth.c > +++ b/drivers/net/ethernet/marvell/mv643xx_eth.c > @@ -2705,8 +2705,11 @@ static struct platform_device *port_platdev[3]; > static void mv643xx_eth_shared_of_remove(void) > { > int n; > + struct mv643xx_eth_platform_data *pd; > > for (n = 0; n < 3; n++) { > + pd = dev_get_platdata(&port_platdev[n]->dev); > + of_node_put(pd->phy_node); > platform_device_del(port_platdev[n]); > port_platdev[n] = NULL; > } > @@ -2769,8 +2772,10 @@ static int mv643xx_eth_shared_of_add_port(struct platform_device *pdev, > } > > ppdev = platform_device_alloc(MV643XX_ETH_NAME, dev_num); > - if (!ppdev) > - return -ENOMEM; > + if (!ppdev) { > + ret = -ENOMEM; > + goto put_err; > + } > ppdev->dev.coherent_dma_mask = DMA_BIT_MASK(32); > ppdev->dev.of_node = pnp; > > @@ -2792,6 +2797,8 @@ static int mv643xx_eth_shared_of_add_port(struct platform_device *pdev, > > port_err: > platform_device_put(ppdev); > +put_err: > + of_node_put(ppd.phy_node); > return ret; > } > Best, Joe
diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c index a06048719e84..fa30f8c4a0cc 100644 --- a/drivers/net/ethernet/marvell/mv643xx_eth.c +++ b/drivers/net/ethernet/marvell/mv643xx_eth.c @@ -2705,8 +2705,11 @@ static struct platform_device *port_platdev[3]; static void mv643xx_eth_shared_of_remove(void) { int n; + struct mv643xx_eth_platform_data *pd; for (n = 0; n < 3; n++) { + pd = dev_get_platdata(&port_platdev[n]->dev); + of_node_put(pd->phy_node); platform_device_del(port_platdev[n]); port_platdev[n] = NULL; } @@ -2769,8 +2772,10 @@ static int mv643xx_eth_shared_of_add_port(struct platform_device *pdev, } ppdev = platform_device_alloc(MV643XX_ETH_NAME, dev_num); - if (!ppdev) - return -ENOMEM; + if (!ppdev) { + ret = -ENOMEM; + goto put_err; + } ppdev->dev.coherent_dma_mask = DMA_BIT_MASK(32); ppdev->dev.of_node = pnp; @@ -2792,6 +2797,8 @@ static int mv643xx_eth_shared_of_add_port(struct platform_device *pdev, port_err: platform_device_put(ppdev); +put_err: + of_node_put(ppd.phy_node); return ret; }
Current implementation of mv643xx_eth_shared_of_add_port() calls of_parse_phandle(), but does not release the refcount on error. Call of_node_put() in the error path and in mv643xx_eth_shared_of_remove(). This bug was found by an experimental static analysis tool that I am developing. Fixes: 76723bca2802 ("net: mv643xx_eth: add DT parsing support") Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp> --- drivers/net/ethernet/marvell/mv643xx_eth.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)