Skip to contentSkip to conversation

serial/sunsu: fix refcount leak

PATCH Applied Yangtao Li 2 participants 4 messages Dec 12, 2018 – Dec 21, 2018

Subsystems (2)
lore
Share & tools
lore

Yangtao Li

author
#0 lore raw

PATCH 1/1 serial/sunsu: fix refcount leak

The function of_find_node_by_path() acquires a reference to the node returned by it and that reference needs to be dropped by its caller.

su_get_type() doesn't do that. The match node are used as an identifier to compare against the current node, so we can directly drop the refcount after getting the node from the path as it is not used as pointer.

Fix this by use a single variable and drop the refcount right after of_find_node_by_path().

---
 drivers/tty/serial/sunsu.c | 31 ++++++++++++++++++++++++++-----
 1 file changed, 26 insertions(+), 5 deletions(-)
drivers/tty/serial/sunsu.c +26 -5
index 6cf3e9b0728f..c5428b0426a9 100644
@@ -1394,22 +1394,43 @@ static inline struct console *SUNSU_CONSOLE(void)
 static enum su_type su_get_type(struct device_node *dp)
 {
 	struct device_node *ap = of_find_node_by_path("/aliases");
+	enum su_type rc = SU_PORT_PORT;
 
 	if (ap) {
 		const char *keyb = of_get_property(ap, "keyboard", NULL);
 		const char *ms = of_get_property(ap, "mouse", NULL);
+		struct device_node *match;
 
 		if (keyb) {
-			if (dp == of_find_node_by_path(keyb))
-				return SU_PORT_KBD;
+			match = of_find_node_by_path(keyb);
+
+			/*
+			 * The pointer is used as an identifier not
+			 * as a pointer, we can drop the refcount on
+			 * the of__node immediately after getting it.
+			 */
+			of_node_put(match);
+
+			if (dp == match) {
+				rc = SU_PORT_KBD;
+				goto out;
+			}
 		}
 		if (ms) {
-			if (dp == of_find_node_by_path(ms))
-				return SU_PORT_MS;
+			match = of_find_node_by_path(ms);
+
+			of_node_put(match);
+
+			if (dp == match) {
+				rc = SU_PORT_MS;
+				goto out;
+			}
 		}
 	}
 
-	return SU_PORT_PORT;
+out:
+	of_node_put(ap);
+	return rc;
 }
 
 static int su_probe(struct platform_device *op)
Signature · 1 line
2.17.0
author
#1 lore raw

Sorry for got to add a prefix(PATCH v2).
I hope this has no effect.

MBR,
Yangtao

maintainer Applied
#3 lore raw
In reply to Yangtao Li

From: Yangtao Li <[email protected]>
Date: Wed, 12 Dec 2018 11:01:45 -0500

Quoted 11 lines

The function of_find_node_by_path() acquires a reference to the node returned by it and that reference needs to be dropped by its caller.

su_get_type() doesn't do that. The match node are used as an identifier to compare against the current node, so we can directly drop the refcount after getting the node from the path as it is not used as pointer.

Fix this by use a single variable and drop the refcount right after of_find_node_by_path().

Applied.