backlight: as3711_bl: fix device-tree node lookup

Fix child-node lookup during probe, which ended up searching the whole device tree depth-first starting at the parent rather than just matching on its children.

To make things worse, the parent mfd node was also prematurely freed, while the child backlight node was leaked.

Fixes 47ec340cb8e2 ("mfd: max8925: Support dt for backlight")

Cc stable <[email protected]> # 3.9

Cc Qing Xu <[email protected]>

Cc Haojian Zhuang <[email protected]>

Signed-off-by Johan Hovold <[email protected]>

---
  drivers/video/backlight/max8925_bl.c | 4 +++-
  1 file changed, 3 insertions(+), 1 deletion(-)

drivers/video/backlight/max8925_bl.c +3 -1

index 7b738d60ecc2..f3aa6088f1d9 100644
@@ -116,7 +116,7 @@ static void max8925_backlight_dt_init(struct platform_device *pdev)
  	if (!pdata)
  		return;
 
-	np = of_find_node_by_name(nproot, "backlight");
+	np = of_get_child_by_name(nproot, "backlight");
  	if (!np) {
  		dev_err(&pdev->dev, "failed to find backlight node\n");
  		return;

@@ -125,6 +125,8 @@ static void max8925_backlight_dt_init(struct platform_device *pdev)
  	if (!of_property_read_u32(np, "maxim,max8925-dual-string", &val))
  		pdata->dual_string = val;
 
+	of_node_put(np);
+
  	pdev->dev.platform_data = pdata;
  }
 

Fix child-node lookup during probe, which ended up searching the whole device tree depth-first starting at the parent rather than just matching on its children.

This would only cause trouble if the child node is missing while there is an unrelated node named "backlight" elsewhere in the tree.

Fixes eebfdc17cc6c ("backlight: Add TPS65217 WLED driver")

Cc stable <[email protected]> # 3.7

Cc Matthias Kaehlcke <[email protected]>

Signed-off-by Johan Hovold <[email protected]>

---
  drivers/video/backlight/tps65217_bl.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)

drivers/video/backlight/tps65217_bl.c +2 -2

index 380917c86276..762e3feed097 100644
@@ -184,11 +184,11 @@ static struct tps65217_bl_pdata *
  tps65217_bl_parse_dt(struct platform_device *pdev)
  {
  	struct tps65217 *tps = dev_get_drvdata(pdev->dev.parent);
-	struct device_node *node = of_node_get(tps->dev->of_node);
+	struct device_node *node;
  	struct tps65217_bl_pdata *pdata, *err;
  	u32 val;
 
-	node = of_find_node_by_name(node, "backlight");
+	node = of_get_child_by_name(tps->dev->of_node, "backlight");
  	if (!node)
  		return ERR_PTR(-ENODEV);
 

Fix child-node lookup during probe, which ended up searching the whole device tree depth-first starting at the parent rather than just matching on its children.

To make things worse, the parent mfd node was also prematurely freed.

Note that the nodes returned from the two calls to of_parse_phandle() are also leaking, but fixing that is a bit more involved as pointers to node fields are being stored for later use.

Fixes 59eb2b5e57ea ("drivers/video/backlight/as3711_bl.c: add OF support")

Cc stable <[email protected]> # 3.10

Cc Guennadi Liakhovetski <[email protected]>

Signed-off-by Johan Hovold <[email protected]>

---
  drivers/video/backlight/as3711_bl.c | 35 +++++++++++++++++++++++++----------
  1 file changed, 25 insertions(+), 10 deletions(-)

drivers/video/backlight/as3711_bl.c +25 -10

index 734a9158946b..21ce56053c88 100644
@@ -262,15 +262,16 @@ static int as3711_bl_register(struct platform_device *pdev,
  static int as3711_backlight_parse_dt(struct device *dev)
  {
  	struct as3711_bl_pdata *pdata = dev_get_platdata(dev);
-	struct device_node *bl =
-		of_find_node_by_name(dev->parent->of_node, "backlight"), *fb;
+	struct device_node *bl, *fb;
  	int ret;
 
+	bl = of_get_child_by_name(dev->parent->of_node, "backlight");
  	if (!bl) {
  		dev_dbg(dev, "backlight node not found\n");
  		return -ENODEV;
  	}
 
+	/* FIXME: need to drop reference to returned node */
  	fb = of_parse_phandle(bl, "su1-dev", 0);
  	if (fb) {
  		pdata->su1_fb = fb->full_name;

@@ -279,9 +280,10 @@ static int as3711_backlight_parse_dt(struct device *dev)
  		if (pdata->su1_max_uA <= 0)
  			ret = -EINVAL;
  		if (ret < 0)
-			return ret;
+			goto err_put_bl;
  	}
 
+	/* FIXME: need to drop reference to returned node */
  	fb = of_parse_phandle(bl, "su2-dev", 0);
  	if (fb) {
  		int count = 0;

@@ -292,7 +294,7 @@ static int as3711_backlight_parse_dt(struct device *dev)
  		if (pdata->su2_max_uA <= 0)
  			ret = -EINVAL;
  		if (ret < 0)
-			return ret;
+			goto err_put_bl;
 
  		if (of_find_property(bl, "su2-feedback-voltage", NULL)) {
  			pdata->su2_feedback = AS3711_SU2_VOLTAGE;

@@ -314,8 +316,10 @@ static int as3711_backlight_parse_dt(struct device *dev)
  			pdata->su2_feedback = AS3711_SU2_CURR_AUTO;
  			count++;
  		}
-		if (count != 1)
-			return -EINVAL;
+		if (count != 1) {
+			ret = -EINVAL;
+			goto err_put_bl;
+		}
 
  		count = 0;
  		if (of_find_property(bl, "su2-fbprot-lx-sd4", NULL)) {

@@ -334,8 +338,10 @@ static int as3711_backlight_parse_dt(struct device *dev)
  			pdata->su2_fbprot = AS3711_SU2_GPIO4;
  			count++;
  		}
-		if (count != 1)
-			return -EINVAL;
+		if (count != 1) {
+			ret = -EINVAL;
+			goto err_put_bl;
+		}
 
  		count = 0;
  		if (of_find_property(bl, "su2-auto-curr1", NULL)) {

@@ -355,11 +361,20 @@ static int as3711_backlight_parse_dt(struct device *dev)
  		 * At least one su2-auto-curr* must be specified iff
  		 * AS3711_SU2_CURR_AUTO is used
  		 */
-		if (!count ^ (pdata->su2_feedback != AS3711_SU2_CURR_AUTO))
-			return -EINVAL;
+		if (!count ^ (pdata->su2_feedback != AS3711_SU2_CURR_AUTO)) {
+			ret = -EINVAL;
+			goto err_put_bl;
+		}
  	}
 
+	of_node_put(bl);
+
  	return 0;
+
+err_put_bl:
+	of_node_put(bl);
+
+	return ret;
  }
 
  static int as3711_backlight_probe(struct platform_device *pdev)

Quoted 4 lines · Johan Hovold

Fix child-node lookup during probe, which ended up searching the whole device tree depth-first starting at the parent rather than just matching on its children.

Quoted 5 lines

To make things worse, the parent mfd node was also prematurely freed.

Note that the nodes returned from the two calls to of_parse_phandle() are also leaking, but fixing that is a bit more involved as pointers to node fields are being stored for later use.

Is using a devm_kstrdup() to remember the full_name sufficient so get each of the FIXMEs cleaned up as well?

Quoted 5 lines · Daniel Thompson

Quoted 4 lines · Johan Hovold

Fix child-node lookup during probe, which ended up searching the whole device tree depth-first starting at the parent rather than just matching on its children.

Quoted 8 lines

Quoted 5 lines

To make things worse, the parent mfd node was also prematurely freed.

Note that the nodes returned from the two calls to of_parse_phandle() are also leaking, but fixing that is a bit more involved as pointers to node fields are being stored for later use.

Is using a devm_kstrdup() to remember the full_name sufficient so get each of the FIXMEs cleaned up as well?

Yeah, that may be sufficient, but looking closer at this now, it seems the name pointers (su1_fb and su2_fb) are only used as booleans, and the fb_name pointer in struct as3711_bl_data is never used at all.

So cleaning that up somehow (e.g. and maybe even dropping non-dt probing) would also work.

But since this is a separate, and less critical issue, I think it needs to be done as a follow up to this one.

Quoted 19 lines · Johan Hovold

Quoted 5 lines · Daniel Thompson

Quoted 4 lines · Johan Hovold

Fix child-node lookup during probe, which ended up searching the whole device tree depth-first starting at the parent rather than just matching on its children.

Quoted 8 lines

Quoted 5 lines

To make things worse, the parent mfd node was also prematurely freed.

Note that the nodes returned from the two calls to of_parse_phandle() are also leaking, but fixing that is a bit more involved as pointers to node fields are being stored for later use.

Is using a devm_kstrdup() to remember the full_name sufficient so get each of the FIXMEs cleaned up as well?

Yeah, that may be sufficient, but looking closer at this now, it seems the name pointers (su1_fb and su2_fb) are only used as booleans, and the fb_name pointer in struct as3711_bl_data is never used at all.

Quoted 5 lines

So cleaning that up somehow (e.g. and maybe even dropping non-dt probing) would also work.

But since this is a separate, and less critical issue, I think it needs to be done as a follow up to this one.

To be honest it was adding the separate and less critical FIXMEs into the patches that attracted my attention in the first place. ;-)

Quoted 26 lines · Daniel Thompson

Quoted 24 lines · Johan Hovold

Quoted 5 lines · Daniel Thompson

Quoted 4 lines · Johan Hovold

Fix child-node lookup during probe, which ended up searching the whole device tree depth-first starting at the parent rather than just matching on its children.

Quoted 8 lines

Quoted 5 lines

To make things worse, the parent mfd node was also prematurely freed.

Note that the nodes returned from the two calls to of_parse_phandle() are also leaking, but fixing that is a bit more involved as pointers to node fields are being stored for later use.

Is using a devm_kstrdup() to remember the full_name sufficient so get each of the FIXMEs cleaned up as well?

Yeah, that may be sufficient, but looking closer at this now, it seems the name pointers (su1_fb and su2_fb) are only used as booleans, and the fb_name pointer in struct as3711_bl_data is never used at all.

So cleaning that up somehow (e.g. and maybe even dropping non-dt probing) would also work.

But since this is a separate, and less critical issue, I think it needs to be done as a follow up to this one.

Quoted 2 lines

To be honest it was adding the separate and less critical FIXMEs into the patches that attracted my attention in the first place. ;-)

Heh. Since I was touching those error paths, I at least wanted to record somehow there were further issues to be addressed. But feel free to drop the FIXMEs if you prefer.

Quoted 27 lines · Johan Hovold

Quoted 26 lines · Daniel Thompson

Quoted 24 lines · Johan Hovold

Quoted 5 lines · Daniel Thompson

Quoted 4 lines · Johan Hovold

Fix child-node lookup during probe, which ended up searching the whole device tree depth-first starting at the parent rather than just matching on its children.

Quoted 8 lines

Quoted 5 lines

To make things worse, the parent mfd node was also prematurely freed.

Note that the nodes returned from the two calls to of_parse_phandle() are also leaking, but fixing that is a bit more involved as pointers to node fields are being stored for later use.

Is using a devm_kstrdup() to remember the full_name sufficient so get each of the FIXMEs cleaned up as well?

Yeah, that may be sufficient, but looking closer at this now, it seems the name pointers (su1_fb and su2_fb) are only used as booleans, and the fb_name pointer in struct as3711_bl_data is never used at all.

So cleaning that up somehow (e.g. and maybe even dropping non-dt probing) would also work.

But since this is a separate, and less critical issue, I think it needs to be done as a follow up to this one.

Quoted 6 lines

Quoted 2 lines

To be honest it was adding the separate and less critical FIXMEs into the patches that attracted my attention in the first place. ;-)

Heh. Since I was touching those error paths, I at least wanted to record somehow there were further issues to be addressed. But feel free to drop the FIXMEs if you prefer.

In my experience FIXME's tend not to get addressed:

$ git grep -i fixme | wc -l
4431

Submit patches instead. :)

Quoted 38 lines · Lee Jones

Quoted 27 lines · Johan Hovold

Quoted 26 lines · Daniel Thompson

Quoted 24 lines · Johan Hovold

Quoted 5 lines · Daniel Thompson

Quoted 4 lines · Johan Hovold

Fix child-node lookup during probe, which ended up searching the whole device tree depth-first starting at the parent rather than just matching on its children.

Quoted 8 lines

Quoted 5 lines

To make things worse, the parent mfd node was also prematurely freed.

Note that the nodes returned from the two calls to of_parse_phandle() are also leaking, but fixing that is a bit more involved as pointers to node fields are being stored for later use.

Is using a devm_kstrdup() to remember the full_name sufficient so get each of the FIXMEs cleaned up as well?

Yeah, that may be sufficient, but looking closer at this now, it seems the name pointers (su1_fb and su2_fb) are only used as booleans, and the fb_name pointer in struct as3711_bl_data is never used at all.

So cleaning that up somehow (e.g. and maybe even dropping non-dt probing) would also work.

But since this is a separate, and less critical issue, I think it needs to be done as a follow up to this one.

Quoted 6 lines

Quoted 2 lines

To be honest it was adding the separate and less critical FIXMEs into the patches that attracted my attention in the first place. ;-)

Heh. Since I was touching those error paths, I at least wanted to record somehow there were further issues to be addressed. But feel free to drop the FIXMEs if you prefer.

In my experience FIXME's tend not to get addressed:

Quoted 4 lines

$ git grep -i fixme | wc -l
4431

Submit patches instead. :)

There may be some truth to that, but I still think it's better to mark what is broken (especially since a leaked node is no big deal in this case) than to just ignore and forget about it.

Quoted 44 lines · Johan Hovold

Quoted 42 lines · Lee Jones

Quoted 27 lines · Johan Hovold

Quoted 26 lines · Daniel Thompson

Quoted 24 lines · Johan Hovold

Quoted 5 lines · Daniel Thompson

Quoted 4 lines · Johan Hovold

Fix child-node lookup during probe, which ended up searching the whole device tree depth-first starting at the parent rather than just matching on its children.

Quoted 8 lines

Quoted 5 lines

To make things worse, the parent mfd node was also prematurely freed.

Note that the nodes returned from the two calls to of_parse_phandle() are also leaking, but fixing that is a bit more involved as pointers to node fields are being stored for later use.

Is using a devm_kstrdup() to remember the full_name sufficient so get each of the FIXMEs cleaned up as well?

Yeah, that may be sufficient, but looking closer at this now, it seems the name pointers (su1_fb and su2_fb) are only used as booleans, and the fb_name pointer in struct as3711_bl_data is never used at all.

So cleaning that up somehow (e.g. and maybe even dropping non-dt probing) would also work.

But since this is a separate, and less critical issue, I think it needs to be done as a follow up to this one.

Quoted 6 lines

Quoted 2 lines

To be honest it was adding the separate and less critical FIXMEs into the patches that attracted my attention in the first place. ;-)

Heh. Since I was touching those error paths, I at least wanted to record somehow there were further issues to be addressed. But feel free to drop the FIXMEs if you prefer.

In my experience FIXME's tend not to get addressed:

$ git grep -i fixme | wc -l
4431

Submit patches instead. :)

Quoted 3 lines

There may be some truth to that, but I still think it's better to mark what is broken (especially since a leaked node is no big deal in this case) than to just ignore and forget about it.

I just sent a v2 including a new patch fixing these node leaks instead of just flagging them. The driver really had no business storing those node full_name fields in the first place.