bus: vexpress-config: fix device reference leak

Make sure to drop the reference to the parent device taken by class_find_device() after populating the bus.

---
 drivers/bus/vexpress-config.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

index 9efdf1de4035..493e7b9fc813 100644
@@ -171,6 +171,7 @@ static int vexpress_config_populate(struct device_node *node)
 {
 	struct device_node *bridge;
 	struct device *parent;
+	int ret;
 
 	bridge = of_parse_phandle(node, "arm,vexpress,config-bridge", 0);
 	if (!bridge)

@@ -182,7 +183,11 @@ static int vexpress_config_populate(struct device_node *node)
 	if (WARN_ON(!parent))
 		return -ENODEV;
 
-	return of_platform_populate(node, NULL, NULL, parent);
+	ret = of_platform_populate(node, NULL, NULL, parent);
+
+	put_device(parent);
+
+	return ret;
 }
 
 static int __init vexpress_config_init(void)

2.7.3

You're right. May I ask how did you figure it out? The get_device() happening in class_find_device() is a bit obscure, so have you simply followed places where it's being used or used some static (?) analysis tool? If the latter, I'd be very curios to hear what was it :-)

Thanks!

Pawel

It's not obscure at all - all the functions that find a device do so under a lock to ensure that the device does not go away, and they take a reference count on the device before returning the pointer for exactly the same reason.

If they didn't do that, the find function could locate a struct device while another thread is deleting the struct device, and it would then return a stale pointer - and dereferencing that pointer would then be a use-after-free bug.

So not obscure, but rather fundamentally necessary.

RMK's Patch system: http://www.armlinux.org.uk/developer/patches/
FTTC broadband for 0.8mile line: currently at 9.6Mbps down 400kbps up
according to speedtest.net.

I stumbled over one of these leaks and grepped and searched for more. I've submitted a few patches this week fixing some of the more obvious ones, but there are more lurking behind various subsystem wrappers.

Thanks,
Johan

Thanks for the fix. I somehow missed this patch, sorry for that. Not sure if arm-soc guys take this as a fix for v4.9, and I have already sent PR for v4.10. I will repost this along with the ack and check with them.

Regards,
Sudeep