The various for_each device_node iterators performs an of_node_get on each
iteration, so a break out of the loop requires an of_node_put.
The complete semantic patch that fixes this problem is
(http://coccinelle.lip6.fr):
// <smpl>
@r@
local idexpression n;
expression e1,e2;
iterator name for_each_node_by_name, for_each_node_by_type,
for_each_compatible_node, for_each_matching_node,
for_each_matching_node_and_match, for_each_child_of_node,
for_each_available_child_of_node, for_each_node_with_property;
iterator i;
statement S;
expression list [n1] es;
@@
(
(
for_each_node_by_name(n,e1) S
|
for_each_node_by_type(n,e1) S
|
for_each_compatible_node(n,e1,e2) S
|
for_each_matching_node(n,e1) S
|
for_each_matching_node_and_match(n,e1,e2) S
|
for_each_child_of_node(e1,n) S
|
for_each_available_child_of_node(e1,n) S
|
for_each_node_with_property(n,e1) S
)
&
i(es,n,...) S
)
@@
local idexpression r.n;
iterator r.i;
expression e;
expression list [r.n1] es;
@@
i(es,n,...) {
...
(
of_node_put(n);
|
e = n
|
return n;
|
+ of_node_put(n);
? return ...;
)
...
}
@@
local idexpression r.n;
iterator r.i;
expression e;
expression list [r.n1] es;
@@
i(es,n,...) {
...
(
of_node_put(n);
|
e = n
|
+ of_node_put(n);
? break;
)
...
}
... when != n
@@
local idexpression r.n;
iterator r.i;
expression e;
identifier l;
expression list [r.n1] es;
@@
i(es,n,...) {
...
(
of_node_put(n);
|
e = n
|
+ of_node_put(n);
? goto l;
)
...
}
...
l: ... when != n// </smpl>
---
drivers/iio/adc/qcom-spmi-vadc.c | 4 +++-
drivers/mtd/nand/brcmnand/brcmnand.c | 14 ++++++++++----
drivers/mtd/nand/sunxi_nand.c | 4 +++-
drivers/power/reset/at91-reset.c | 1 +
4 files changed, 17 insertions(+), 6 deletions(-)
This patch addresses several related memory management issues in the probe
function:
1. for_each_available_child_of_node performs an of_node_get on each
iteration, so a break out of the loop requires an of_node_put.
A simplified version of the semantic patch that fixes this problem is as
follows (http://coccinelle.lip6.fr):
// <smpl>
@@
expression root,e;
local idexpression child;
@@
for_each_available_child_of_node(root, child) {
... when != of_node_put(child)
when != e = child
(
return child;
|
+ of_node_put(child);
? return ...;
)
...
}
// </smpl>
2. The devm_kzalloc'd data is not used if brcmnand_init_cs fails. Free it
immediately, using devm_kfree in this case, instead of waiting for the
remove function.
3. If the continue is not taken, then host is added to a list, that has a
lifetime beyond the end of the for_each_available_child_of_node loop body.
Thus, of_node_get is needed on child, which is referenced by host. A
corresponding of_node_put is needed in the remove function.
Signed-off-by: Julia Lawall <[email protected]>
---
One could consider whether the of_node_get should be on host->of_node,
which looks more similar to the thing that is stored in the list. I used
child, to be more similar to the of_node_put in the same function.
drivers/mtd/nand/brcmnand/brcmnand.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c
index 2a437c7..b0cb55d 100644
--- a/drivers/mtd/nand/brcmnand/brcmnand.c
+++ b/drivers/mtd/nand/brcmnand/brcmnand.c
@@ -2237,16 +2237,20 @@ int brcmnand_probe(struct platform_device *pdev, struct brcmnand_soc *soc)
struct brcmnand_host *host;
host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL);
- if (!host)
+ if (!host) {
+ of_node_put(child);
return -ENOMEM;
+ }
host->pdev = pdev;
host->ctrl = ctrl;
host->of_node = child;
ret = brcmnand_init_cs(host);
- if (ret)
+ if (ret) {
+ devm_kfree(dev, host);
continue; /* Try all chip-selects */
-
+ }
+ of_node_get(child);
list_add_tail(&host->node, &ctrl->host_list);
}
}
@@ -2264,8 +2268,10 @@ int brcmnand_remove(struct platform_device *pdev)
struct brcmnand_controller *ctrl = dev_get_drvdata(&pdev->dev);
struct brcmnand_host *host;
- list_for_each_entry(host, &ctrl->host_list, node)
+ list_for_each_entry(host, &ctrl->host_list, node) {
+ of_node_put(host->of_node);
nand_release(&host->mtd);
+ }
dev_set_drvdata(&pdev->dev, NULL);
for_each_child_of_node performs an of_node_get on each iteration, so
a break out of the loop requires an of_node_put.
A simplified version of the semantic patch that fixes this problem is as
follows (http://coccinelle.lip6.fr):
// <smpl>
@@
expression root,e;
local idexpression child;
@@
for_each_child_of_node(root, child) {
... when != of_node_put(child)
when != e = child
(
return child;
|
+ of_node_put(child);
? return ...;
)
...
}
// </smpl>
Signed-off-by: Julia Lawall <[email protected]>
---
drivers/mtd/nand/sunxi_nand.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/mtd/nand/sunxi_nand.c b/drivers/mtd/nand/sunxi_nand.c
index 2ed52e4..1bbcc0c 100644
--- a/drivers/mtd/nand/sunxi_nand.c
+++ b/drivers/mtd/nand/sunxi_nand.c
@@ -1391,8 +1391,10 @@ static int sunxi_nand_chips_init(struct device *dev, struct sunxi_nfc *nfc)
for_each_child_of_node(np, nand_np) {
ret = sunxi_nand_chip_init(dev, nfc, nand_np);
- if (ret)
+ if (ret) {
+ of_node_put(nand_np);
return ret;
+ }
}
return 0;
for_each_available_child_of_node performs an of_node_get on each iteration,
so a break out of the loop requires an of_node_put.
A simplified version of the semantic patch that fixes this problem is as
follows (http://coccinelle.lip6.fr):
// <smpl>
@@
expression root,e;
local idexpression child;
@@
for_each_available_child_of_node(root, child) {
... when != of_node_put(child)
when != e = child
(
return child;
|
+ of_node_put(child);
? return ...;
)
...
}
// </smpl>
Signed-off-by: Julia Lawall <[email protected]>
---
drivers/iio/adc/qcom-spmi-vadc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/iio/adc/qcom-spmi-vadc.c b/drivers/iio/adc/qcom-spmi-vadc.c
index 0c4618b..c2babe5 100644
--- a/drivers/iio/adc/qcom-spmi-vadc.c
+++ b/drivers/iio/adc/qcom-spmi-vadc.c
@@ -839,8 +839,10 @@ static int vadc_get_dt_data(struct vadc_priv *vadc, struct device_node *node)
for_each_available_child_of_node(node, child) {
ret = vadc_get_dt_channel_data(vadc->dev, &prop, child);
- if (ret)
+ if (ret) {
+ of_node_put(child);
return ret;
+ }
vadc->chan_props[index] = prop;
for_each_matching_node performs an of_node_get on each iteration, so
a break out of the loop requires an of_node_put.
A simplified version of the semantic patch that fixes this problem is as
follows (http://coccinelle.lip6.fr):
// <smpl>
@@
expression e,e1;
local idexpression np;
@@
for_each_matching_node(np, e1) {
... when != of_node_put(np)
when != e = np
(
return np;
|
+ of_node_put(np);
? return ...;
)
...
}
// </smpl>
Signed-off-by: Julia Lawall <[email protected]>
---
drivers/power/reset/at91-reset.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/power/reset/at91-reset.c b/drivers/power/reset/at91-reset.c
index 3f6b5dd..1b5d450 100644
--- a/drivers/power/reset/at91-reset.c
+++ b/drivers/power/reset/at91-reset.c
@@ -198,6 +198,7 @@ static int __init at91_reset_probe(struct platform_device *pdev)
at91_ramc_base[idx] = of_iomap(np, 0);
if (!at91_ramc_base[idx]) {
dev_err(&pdev->dev, "Could not map ram controller address\n");
+ of_node_put(np);
return -ENODEV;
}
idx++;
On Wed, Nov 18, 2015 at 11:04:11PM +0100, Julia Lawall wrote:
> This patch addresses several related memory management issues in the probe
> function:
>
> 1. for_each_available_child_of_node performs an of_node_get on each
> iteration, so a break out of the loop requires an of_node_put.
>
> A simplified version of the semantic patch that fixes this problem is as
> follows (http://coccinelle.lip6.fr):
>
> // <smpl>
> @@
> expression root,e;
> local idexpression child;
> @@
>
> for_each_available_child_of_node(root, child) {
> ... when != of_node_put(child)
> when != e = child
> (
> return child;
> |
> + of_node_put(child);
> ? return ...;
> )
> ...
> }
> // </smpl>
Good catch again
> 2. The devm_kzalloc'd data is not used if brcmnand_init_cs fails. Free it
> immediately, using devm_kfree in this case, instead of waiting for the
> remove function.
Same
> 3. If the continue is not taken, then host is added to a list, that has a
> lifetime beyond the end of the for_each_available_child_of_node loop body.
> Thus, of_node_get is needed on child, which is referenced by host. A
> corresponding of_node_put is needed in the remove function.
This one's a bit silly. We really shouldn't be keeping the reference in
'host' at all. Also, as of commit 215a02fd3087 ("mtd: grab a reference to
the MTD of_node before registering it"), the MTD core will actually be
refcounting the node for us, too, so this isn't really necessary.
I have a patch to remove brcmnand_host::of_node (appended below), which
should make this step obsolete, and be more obvious that no extra
of_node_get()'ing is required.
> Signed-off-by: Julia Lawall <[email protected]>
>
> ---
>
> One could consider whether the of_node_get should be on host->of_node,
> which looks more similar to the thing that is stored in the list. I used
> child, to be more similar to the of_node_put in the same function.
>
> drivers/mtd/nand/brcmnand/brcmnand.c | 14 ++++++++++----
> 1 file changed, 10 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c
> index 2a437c7..b0cb55d 100644
> --- a/drivers/mtd/nand/brcmnand/brcmnand.c
> +++ b/drivers/mtd/nand/brcmnand/brcmnand.c
> @@ -2237,16 +2237,20 @@ int brcmnand_probe(struct platform_device *pdev, struct brcmnand_soc *soc)
> struct brcmnand_host *host;
>
> host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL);
> - if (!host)
> + if (!host) {
> + of_node_put(child);
> return -ENOMEM;
In code reading, I noticed that we don't actually cleanup for prior
iterations of brcmnand_init_cs() here. i.e., if we're exiting here, we
should be doing nand_release() on all previously-registered chips.
> + }
> host->pdev = pdev;
> host->ctrl = ctrl;
> host->of_node = child;
>
> ret = brcmnand_init_cs(host);
> - if (ret)
> + if (ret) {
> + devm_kfree(dev, host);
> continue; /* Try all chip-selects */
> -
> + }
> + of_node_get(child);
> list_add_tail(&host->node, &ctrl->host_list);
> }
> }
> @@ -2264,8 +2268,10 @@ int brcmnand_remove(struct platform_device *pdev)
> struct brcmnand_controller *ctrl = dev_get_drvdata(&pdev->dev);
> struct brcmnand_host *host;
>
> - list_for_each_entry(host, &ctrl->host_list, node)
> + list_for_each_entry(host, &ctrl->host_list, node) {
> + of_node_put(host->of_node);
> nand_release(&host->mtd);
> + }
>
> dev_set_drvdata(&pdev->dev, NULL);
>
Patch to kill off some of this:
---8<---
>From 6c51a9ef1325e7b06a7623c1fbca1adf6eeb8253 Mon Sep 17 00:00:00 2001
From: Brian Norris <[email protected]>
Date: Wed, 18 Nov 2015 14:33:24 -0800
Subject: [PATCH] mtd: brcmnand: drop brcmnand_host::of_node field
We don't actually need to stash a copy of this device_node indefinitely;
we only need it in brcmnand_init_cs().
Signed-off-by: Brian Norris <[email protected]>
Cc: <[email protected]>
Cc: Kamal Dasu <[email protected]>
---
drivers/mtd/nand/brcmnand/brcmnand.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c
index c395b4a75fb1..351438a62aaa 100644
--- a/drivers/mtd/nand/brcmnand/brcmnand.c
+++ b/drivers/mtd/nand/brcmnand/brcmnand.c
@@ -176,7 +176,6 @@ struct brcmnand_cfg {
struct brcmnand_host {
struct list_head node;
- struct device_node *of_node;
struct nand_chip chip;
struct mtd_info mtd;
@@ -1896,10 +1895,9 @@ static int brcmnand_setup_dev(struct brcmnand_host *host)
return 0;
}
-static int brcmnand_init_cs(struct brcmnand_host *host)
+static int brcmnand_init_cs(struct brcmnand_host *host, struct device_node *dn)
{
struct brcmnand_controller *ctrl = host->ctrl;
- struct device_node *dn = host->of_node;
struct platform_device *pdev = host->pdev;
struct mtd_info *mtd;
struct nand_chip *chip;
@@ -2231,9 +2229,8 @@ int brcmnand_probe(struct platform_device *pdev, struct brcmnand_soc *soc)
return -ENOMEM;
host->pdev = pdev;
host->ctrl = ctrl;
- host->of_node = child;
- ret = brcmnand_init_cs(host);
+ ret = brcmnand_init_cs(host, child);
if (ret)
continue; /* Try all chip-selects */
--
2.6.0.rc2.230.g3dd15c0
On Wed, 18 Nov 2015, Brian Norris wrote:
> On Wed, Nov 18, 2015 at 11:04:11PM +0100, Julia Lawall wrote:
> > This patch addresses several related memory management issues in the probe
> > function:
> >
> > 1. for_each_available_child_of_node performs an of_node_get on each
> > iteration, so a break out of the loop requires an of_node_put.
> >
> > A simplified version of the semantic patch that fixes this problem is as
> > follows (http://coccinelle.lip6.fr):
> >
> > // <smpl>
> > @@
> > expression root,e;
> > local idexpression child;
> > @@
> >
> > for_each_available_child_of_node(root, child) {
> > ... when != of_node_put(child)
> > when != e = child
> > (
> > return child;
> > |
> > + of_node_put(child);
> > ? return ...;
> > )
> > ...
> > }
> > // </smpl>
>
> Good catch again
>
> > 2. The devm_kzalloc'd data is not used if brcmnand_init_cs fails. Free it
> > immediately, using devm_kfree in this case, instead of waiting for the
> > remove function.
>
> Same
>
> > 3. If the continue is not taken, then host is added to a list, that has a
> > lifetime beyond the end of the for_each_available_child_of_node loop body.
> > Thus, of_node_get is needed on child, which is referenced by host. A
> > corresponding of_node_put is needed in the remove function.
>
> This one's a bit silly. We really shouldn't be keeping the reference in
> 'host' at all. Also, as of commit 215a02fd3087 ("mtd: grab a reference to
> the MTD of_node before registering it"), the MTD core will actually be
> refcounting the node for us, too, so this isn't really necessary.
>
> I have a patch to remove brcmnand_host::of_node (appended below), which
> should make this step obsolete, and be more obvious that no extra
> of_node_get()'ing is required.
OK. Should I resend my patch without this change?
julia
> > Signed-off-by: Julia Lawall <[email protected]>
> >
> > ---
> >
> > One could consider whether the of_node_get should be on host->of_node,
> > which looks more similar to the thing that is stored in the list. I used
> > child, to be more similar to the of_node_put in the same function.
> >
> > drivers/mtd/nand/brcmnand/brcmnand.c | 14 ++++++++++----
> > 1 file changed, 10 insertions(+), 4 deletions(-)
> >
> > diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c
> > index 2a437c7..b0cb55d 100644
> > --- a/drivers/mtd/nand/brcmnand/brcmnand.c
> > +++ b/drivers/mtd/nand/brcmnand/brcmnand.c
> > @@ -2237,16 +2237,20 @@ int brcmnand_probe(struct platform_device *pdev, struct brcmnand_soc *soc)
> > struct brcmnand_host *host;
> >
> > host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL);
> > - if (!host)
> > + if (!host) {
> > + of_node_put(child);
> > return -ENOMEM;
>
> In code reading, I noticed that we don't actually cleanup for prior
> iterations of brcmnand_init_cs() here. i.e., if we're exiting here, we
> should be doing nand_release() on all previously-registered chips.
>
> > + }
> > host->pdev = pdev;
> > host->ctrl = ctrl;
> > host->of_node = child;
> >
> > ret = brcmnand_init_cs(host);
> > - if (ret)
> > + if (ret) {
> > + devm_kfree(dev, host);
> > continue; /* Try all chip-selects */
> > -
> > + }
> > + of_node_get(child);
> > list_add_tail(&host->node, &ctrl->host_list);
> > }
> > }
> > @@ -2264,8 +2268,10 @@ int brcmnand_remove(struct platform_device *pdev)
> > struct brcmnand_controller *ctrl = dev_get_drvdata(&pdev->dev);
> > struct brcmnand_host *host;
> >
> > - list_for_each_entry(host, &ctrl->host_list, node)
> > + list_for_each_entry(host, &ctrl->host_list, node) {
> > + of_node_put(host->of_node);
> > nand_release(&host->mtd);
> > + }
> >
> > dev_set_drvdata(&pdev->dev, NULL);
> >
>
> Patch to kill off some of this:
>
> ---8<---
> From 6c51a9ef1325e7b06a7623c1fbca1adf6eeb8253 Mon Sep 17 00:00:00 2001
> From: Brian Norris <[email protected]>
> Date: Wed, 18 Nov 2015 14:33:24 -0800
> Subject: [PATCH] mtd: brcmnand: drop brcmnand_host::of_node field
>
> We don't actually need to stash a copy of this device_node indefinitely;
> we only need it in brcmnand_init_cs().
>
> Signed-off-by: Brian Norris <[email protected]>
> Cc: <[email protected]>
> Cc: Kamal Dasu <[email protected]>
> ---
> drivers/mtd/nand/brcmnand/brcmnand.c | 7 ++-----
> 1 file changed, 2 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c
> index c395b4a75fb1..351438a62aaa 100644
> --- a/drivers/mtd/nand/brcmnand/brcmnand.c
> +++ b/drivers/mtd/nand/brcmnand/brcmnand.c
> @@ -176,7 +176,6 @@ struct brcmnand_cfg {
>
> struct brcmnand_host {
> struct list_head node;
> - struct device_node *of_node;
>
> struct nand_chip chip;
> struct mtd_info mtd;
> @@ -1896,10 +1895,9 @@ static int brcmnand_setup_dev(struct brcmnand_host *host)
> return 0;
> }
>
> -static int brcmnand_init_cs(struct brcmnand_host *host)
> +static int brcmnand_init_cs(struct brcmnand_host *host, struct device_node *dn)
> {
> struct brcmnand_controller *ctrl = host->ctrl;
> - struct device_node *dn = host->of_node;
> struct platform_device *pdev = host->pdev;
> struct mtd_info *mtd;
> struct nand_chip *chip;
> @@ -2231,9 +2229,8 @@ int brcmnand_probe(struct platform_device *pdev, struct brcmnand_soc *soc)
> return -ENOMEM;
> host->pdev = pdev;
> host->ctrl = ctrl;
> - host->of_node = child;
>
> - ret = brcmnand_init_cs(host);
> + ret = brcmnand_init_cs(host, child);
> if (ret)
> continue; /* Try all chip-selects */
>
> --
> 2.6.0.rc2.230.g3dd15c0
>
> --
> To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
On Thu, Nov 19, 2015 at 07:13:45AM +0100, Julia Lawall wrote:
> On Wed, 18 Nov 2015, Brian Norris wrote:
> > On Wed, Nov 18, 2015 at 11:04:11PM +0100, Julia Lawall wrote:
> > > 3. If the continue is not taken, then host is added to a list, that has a
> > > lifetime beyond the end of the for_each_available_child_of_node loop body.
> > > Thus, of_node_get is needed on child, which is referenced by host. A
> > > corresponding of_node_put is needed in the remove function.
> >
> > This one's a bit silly. We really shouldn't be keeping the reference in
> > 'host' at all. Also, as of commit 215a02fd3087 ("mtd: grab a reference to
> > the MTD of_node before registering it"), the MTD core will actually be
> > refcounting the node for us, too, so this isn't really necessary.
> >
> > I have a patch to remove brcmnand_host::of_node (appended below), which
> > should make this step obsolete, and be more obvious that no extra
> > of_node_get()'ing is required.
>
> OK. Should I resend my patch without this change?
Sure, that'd be good. Then I could merge/rebase mine on top.
Thanks,
Brian
This patch addresses two related memory management issues in the probe
function:
1. for_each_available_child_of_node performs an of_node_get on each
iteration, so a break out of the loop requires an of_node_put.
A simplified version of the semantic patch that fixes this problem is as
follows (http://coccinelle.lip6.fr):
// <smpl>
@@
expression root,e;
local idexpression child;
@@
for_each_available_child_of_node(root, child) {
... when != of_node_put(child)
when != e = child
(
return child;
|
+ of_node_put(child);
? return ...;
)
...
}
// </smpl>
2. The devm_kzalloc'd data is not used if brcmnand_init_cs fails. Free it
immediately, using devm_kfree in this case, instead of waiting for the
remove function.
Signed-off-by: Julia Lawall <[email protected]>
---
v2: Drop of_node_get addition, as another patch will get rid of the need
for it completely.
drivers/mtd/nand/brcmnand/brcmnand.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c
index 2a437c7..551d474 100644
--- a/drivers/mtd/nand/brcmnand/brcmnand.c
+++ b/drivers/mtd/nand/brcmnand/brcmnand.c
@@ -2237,15 +2237,19 @@ int brcmnand_probe(struct platform_device *pdev, struct brcmnand_soc *soc)
struct brcmnand_host *host;
host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL);
- if (!host)
+ if (!host) {
+ of_node_put(child);
return -ENOMEM;
+ }
host->pdev = pdev;
host->ctrl = ctrl;
host->of_node = child;
ret = brcmnand_init_cs(host);
- if (ret)
+ if (ret) {
+ devm_kfree(dev, host);
continue; /* Try all chip-selects */
+ }
list_add_tail(&host->node, &ctrl->host_list);
}
On 18/11/15 22:04, Julia Lawall wrote:
> for_each_available_child_of_node performs an of_node_get on each iteration,
> so a break out of the loop requires an of_node_put.
>
> A simplified version of the semantic patch that fixes this problem is as
> follows (http://coccinelle.lip6.fr):
>
> // <smpl>
> @@
> expression root,e;
> local idexpression child;
> @@
>
> for_each_available_child_of_node(root, child) {
> ... when != of_node_put(child)
> when != e = child
> (
> return child;
> |
> + of_node_put(child);
> ? return ...;
> )
> ...
> }
> // </smpl>
>
> Signed-off-by: Julia Lawall <[email protected]>
Thanks. Applied to the fixes-togreg branch of iio.git and marked for stable.
Jonathan
>
> ---
> drivers/iio/adc/qcom-spmi-vadc.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/iio/adc/qcom-spmi-vadc.c b/drivers/iio/adc/qcom-spmi-vadc.c
> index 0c4618b..c2babe5 100644
> --- a/drivers/iio/adc/qcom-spmi-vadc.c
> +++ b/drivers/iio/adc/qcom-spmi-vadc.c
> @@ -839,8 +839,10 @@ static int vadc_get_dt_data(struct vadc_priv *vadc, struct device_node *node)
>
> for_each_available_child_of_node(node, child) {
> ret = vadc_get_dt_channel_data(vadc->dev, &prop, child);
> - if (ret)
> + if (ret) {
> + of_node_put(child);
> return ret;
> + }
>
> vadc->chan_props[index] = prop;
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-iio" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
On Thu, Nov 19, 2015 at 6:04 AM, Julia Lawall <[email protected]> wrote:
> for_each_child_of_node performs an of_node_get on each iteration, so
> a break out of the loop requires an of_node_put.
>
> A simplified version of the semantic patch that fixes this problem is as
> follows (http://coccinelle.lip6.fr):
>
> // <smpl>
> @@
> expression root,e;
> local idexpression child;
> @@
>
> for_each_child_of_node(root, child) {
> ... when != of_node_put(child)
> when != e = child
> (
> return child;
> |
> + of_node_put(child);
> ? return ...;
> )
> ...
> }
> // </smpl>
>
> Signed-off-by: Julia Lawall <[email protected]>
Acked-by: Chen-Yu Tsai <[email protected]>
On Wed, 18 Nov 2015 23:04:12 +0100
Julia Lawall <[email protected]> wrote:
> for_each_child_of_node performs an of_node_get on each iteration, so
> a break out of the loop requires an of_node_put.
>
> A simplified version of the semantic patch that fixes this problem is as
> follows (http://coccinelle.lip6.fr):
>
> // <smpl>
> @@
> expression root,e;
> local idexpression child;
> @@
>
> for_each_child_of_node(root, child) {
> ... when != of_node_put(child)
> when != e = child
> (
> return child;
> |
> + of_node_put(child);
> ? return ...;
> )
> ...
> }
> // </smpl>
>
> Signed-off-by: Julia Lawall <[email protected]>
Acked-by: Boris Brezillon <[email protected]>
Thanks,
Boris
--
Boris Brezillon, Free Electrons
Embedded Linux and Kernel engineering
http://free-electrons.com
On Thu, Nov 19, 2015 at 10:32:15PM +0100, Julia Lawall wrote:
> This patch addresses two related memory management issues in the probe
> function:
>
> 1. for_each_available_child_of_node performs an of_node_get on each
> iteration, so a break out of the loop requires an of_node_put.
>
> A simplified version of the semantic patch that fixes this problem is as
> follows (http://coccinelle.lip6.fr):
>
> // <smpl>
> @@
> expression root,e;
> local idexpression child;
> @@
>
> for_each_available_child_of_node(root, child) {
> ... when != of_node_put(child)
> when != e = child
> (
> return child;
> |
> + of_node_put(child);
> ? return ...;
> )
> ...
> }
> // </smpl>
>
> 2. The devm_kzalloc'd data is not used if brcmnand_init_cs fails. Free it
> immediately, using devm_kfree in this case, instead of waiting for the
> remove function.
>
> Signed-off-by: Julia Lawall <[email protected]>
>
> ---
>
> v2: Drop of_node_get addition, as another patch will get rid of the need
> for it completely.
Pushed to l2-mtd.git
On Wed, Nov 18, 2015 at 11:04:12PM +0100, Julia Lawall wrote:
> for_each_child_of_node performs an of_node_get on each iteration, so
> a break out of the loop requires an of_node_put.
>
> A simplified version of the semantic patch that fixes this problem is as
> follows (http://coccinelle.lip6.fr):
>
> // <smpl>
> @@
> expression root,e;
> local idexpression child;
> @@
>
> for_each_child_of_node(root, child) {
> ... when != of_node_put(child)
> when != e = child
> (
> return child;
> |
> + of_node_put(child);
> ? return ...;
> )
> ...
> }
> // </smpl>
>
> Signed-off-by: Julia Lawall <[email protected]>
>
Pushed to l2-mtd.git
Hi,
On Wed, Nov 18, 2015 at 11:04:14PM +0100, Julia Lawall wrote:
> for_each_matching_node performs an of_node_get on each iteration, so
> a break out of the loop requires an of_node_put.
>
> A simplified version of the semantic patch that fixes this problem is as
> follows (http://coccinelle.lip6.fr):
>
> // <smpl>
> @@
> expression e,e1;
> local idexpression np;
> @@
>
> for_each_matching_node(np, e1) {
> ... when != of_node_put(np)
> when != e = np
> (
> return np;
> |
> + of_node_put(np);
> ? return ...;
> )
> ...
> }
> // </smpl>
>
> Signed-off-by: Julia Lawall <[email protected]>
Thanks, queued.
-- Sebastian