Device node iterators perform an of_node_put on each iteration, so putting
an of_node_put before a continue results in a double put.
The semantic match that finds this problem is as follows
(http://coccinelle.lip6.fr):
// <smpl>
@@
expression e1;
local idexpression child;
iterator name for_each_child_of_node;
@@
for_each_child_of_node(e1,child) {
... when != of_node_get(child)
* of_node_put(child);
...
* continue;
}
// </smpl>
Furthermore, the call to thermal_of_cooling_device_register immediately
calls __thermal_cooling_device_register with the same arguments. The
latter function stores the device node argument, which is the second
argument of for_each_child_of_node, in the returned thermal_cooling_device
structure. This returned structure is then stored in the cdev field of
stc. Thus it seems that the second argument of for_each_child_of_node
escapes the scope of the for_each_child_of_node, so an explicit of_node_get
on success of thermal_of_cooling_device_register is also needed.
Signed-off-by: Julia Lawall <[email protected]>
---
drivers/thermal/tegra/soctherm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/thermal/tegra/soctherm.c b/drivers/thermal/tegra/soctherm.c
index 7d2db23..10f4fdd 100644
--- a/drivers/thermal/tegra/soctherm.c
+++ b/drivers/thermal/tegra/soctherm.c
@@ -1014,7 +1014,6 @@ static void soctherm_init_hw_throt_cdev(struct platform_device *pdev)
tcd = thermal_of_cooling_device_register(np_stcc,
(char *)name, ts,
&throt_cooling_ops);
- of_node_put(np_stcc);
if (IS_ERR_OR_NULL(tcd)) {
dev_err(dev,
"throttle-cfg: %s: failed to register cooling device\n",
@@ -1022,6 +1021,7 @@ static void soctherm_init_hw_throt_cdev(struct platform_device *pdev)
continue;
}
+ of_node_get(np_stcc);
stc->cdev = tcd;
stc->init = true;
}
On 15/07/17 09:42, Julia Lawall wrote:
> Device node iterators perform an of_node_put on each iteration, so putting
> an of_node_put before a continue results in a double put.
>
> The semantic match that finds this problem is as follows
> (http://coccinelle.lip6.fr):
>
> // <smpl>
> @@
> expression e1;
> local idexpression child;
> iterator name for_each_child_of_node;
> @@
>
> for_each_child_of_node(e1,child) {
> ... when != of_node_get(child)
> * of_node_put(child);
> ...
> * continue;
> }
> // </smpl>
>
> Furthermore, the call to thermal_of_cooling_device_register immediately
> calls __thermal_cooling_device_register with the same arguments. The
> latter function stores the device node argument, which is the second
> argument of for_each_child_of_node, in the returned thermal_cooling_device
> structure. This returned structure is then stored in the cdev field of
> stc. Thus it seems that the second argument of for_each_child_of_node
> escapes the scope of the for_each_child_of_node, so an explicit of_node_get
> on success of thermal_of_cooling_device_register is also needed.
>
> Signed-off-by: Julia Lawall <[email protected]>
>
> ---
> drivers/thermal/tegra/soctherm.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/thermal/tegra/soctherm.c b/drivers/thermal/tegra/soctherm.c
> index 7d2db23..10f4fdd 100644
> --- a/drivers/thermal/tegra/soctherm.c
> +++ b/drivers/thermal/tegra/soctherm.c
> @@ -1014,7 +1014,6 @@ static void soctherm_init_hw_throt_cdev(struct platform_device *pdev)
> tcd = thermal_of_cooling_device_register(np_stcc,
> (char *)name, ts,
> &throt_cooling_ops);
> - of_node_put(np_stcc);
> if (IS_ERR_OR_NULL(tcd)) {
> dev_err(dev,
> "throttle-cfg: %s: failed to register cooling device\n",
> @@ -1022,6 +1021,7 @@ static void soctherm_init_hw_throt_cdev(struct platform_device *pdev)
> continue;
> }
>
> + of_node_get(np_stcc);
> stc->cdev = tcd;
> stc->init = true;
> }
Thanks for fixing this. However, I am wondering if it is better for the
'of_node_get' to be placed within the
thermal_of_cooling_device_register() function as it seems a bit odd if
the caller needs to know that this is being stored for later use.
Also, taking a quick look, I see a couple other drivers calling
thermal_of_cooling_device_register() and they are also not calling
of_node_get on success. So it maybe easier to fix placing it in the
thermal_of_cooling_device_register() function.
Cheers
Jon
--
nvpublic
On Mon, 17 Jul 2017, Jon Hunter wrote:
>
> On 15/07/17 09:42, Julia Lawall wrote:
> > Device node iterators perform an of_node_put on each iteration, so putting
> > an of_node_put before a continue results in a double put.
> >
> > The semantic match that finds this problem is as follows
> > (http://coccinelle.lip6.fr):
> >
> > // <smpl>
> > @@
> > expression e1;
> > local idexpression child;
> > iterator name for_each_child_of_node;
> > @@
> >
> > for_each_child_of_node(e1,child) {
> > ... when != of_node_get(child)
> > * of_node_put(child);
> > ...
> > * continue;
> > }
> > // </smpl>
> >
> > Furthermore, the call to thermal_of_cooling_device_register immediately
> > calls __thermal_cooling_device_register with the same arguments. The
> > latter function stores the device node argument, which is the second
> > argument of for_each_child_of_node, in the returned thermal_cooling_device
> > structure. This returned structure is then stored in the cdev field of
> > stc. Thus it seems that the second argument of for_each_child_of_node
> > escapes the scope of the for_each_child_of_node, so an explicit of_node_get
> > on success of thermal_of_cooling_device_register is also needed.
> >
> > Signed-off-by: Julia Lawall <[email protected]>
> >
> > ---
> > drivers/thermal/tegra/soctherm.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/thermal/tegra/soctherm.c b/drivers/thermal/tegra/soctherm.c
> > index 7d2db23..10f4fdd 100644
> > --- a/drivers/thermal/tegra/soctherm.c
> > +++ b/drivers/thermal/tegra/soctherm.c
> > @@ -1014,7 +1014,6 @@ static void soctherm_init_hw_throt_cdev(struct platform_device *pdev)
> > tcd = thermal_of_cooling_device_register(np_stcc,
> > (char *)name, ts,
> > &throt_cooling_ops);
> > - of_node_put(np_stcc);
> > if (IS_ERR_OR_NULL(tcd)) {
> > dev_err(dev,
> > "throttle-cfg: %s: failed to register cooling device\n",
> > @@ -1022,6 +1021,7 @@ static void soctherm_init_hw_throt_cdev(struct platform_device *pdev)
> > continue;
> > }
> >
> > + of_node_get(np_stcc);
> > stc->cdev = tcd;
> > stc->init = true;
> > }
>
> Thanks for fixing this. However, I am wondering if it is better for the
> 'of_node_get' to be placed within the
> thermal_of_cooling_device_register() function as it seems a bit odd if
> the caller needs to know that this is being stored for later use.
>
> Also, taking a quick look, I see a couple other drivers calling
> thermal_of_cooling_device_register() and they are also not calling
> of_node_get on success. So it maybe easier to fix placing it in the
> thermal_of_cooling_device_register() function.
I'm not an expert, but I had the impression that from some call sites, the
get would have been done already, because the argument is already stored
in some structure. I can check more exhaustively.
julia
>
> Cheers
> Jon
>
> --
> nvpublic
> --
> To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
On Mon, Jul 17, 2017 at 04:42:38PM +0200, Julia Lawall wrote:
>
>
> On Mon, 17 Jul 2017, Jon Hunter wrote:
>
> >
> > On 15/07/17 09:42, Julia Lawall wrote:
> > > Device node iterators perform an of_node_put on each iteration, so putting
> > > an of_node_put before a continue results in a double put.
> > >
> > > The semantic match that finds this problem is as follows
> > > (http://coccinelle.lip6.fr):
> > >
> > > // <smpl>
> > > @@
> > > expression e1;
> > > local idexpression child;
> > > iterator name for_each_child_of_node;
> > > @@
> > >
> > > for_each_child_of_node(e1,child) {
> > > ... when != of_node_get(child)
> > > * of_node_put(child);
> > > ...
> > > * continue;
> > > }
> > > // </smpl>
> > >
> > > Furthermore, the call to thermal_of_cooling_device_register immediately
> > > calls __thermal_cooling_device_register with the same arguments. The
> > > latter function stores the device node argument, which is the second
> > > argument of for_each_child_of_node, in the returned thermal_cooling_device
> > > structure. This returned structure is then stored in the cdev field of
> > > stc. Thus it seems that the second argument of for_each_child_of_node
> > > escapes the scope of the for_each_child_of_node, so an explicit of_node_get
> > > on success of thermal_of_cooling_device_register is also needed.
> > >
> > > Signed-off-by: Julia Lawall <[email protected]>
> > >
> > > ---
> > > drivers/thermal/tegra/soctherm.c | 2 +-
> > > 1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/thermal/tegra/soctherm.c b/drivers/thermal/tegra/soctherm.c
> > > index 7d2db23..10f4fdd 100644
> > > --- a/drivers/thermal/tegra/soctherm.c
> > > +++ b/drivers/thermal/tegra/soctherm.c
> > > @@ -1014,7 +1014,6 @@ static void soctherm_init_hw_throt_cdev(struct platform_device *pdev)
> > > tcd = thermal_of_cooling_device_register(np_stcc,
> > > (char *)name, ts,
> > > &throt_cooling_ops);
> > > - of_node_put(np_stcc);
> > > if (IS_ERR_OR_NULL(tcd)) {
> > > dev_err(dev,
> > > "throttle-cfg: %s: failed to register cooling device\n",
> > > @@ -1022,6 +1021,7 @@ static void soctherm_init_hw_throt_cdev(struct platform_device *pdev)
> > > continue;
> > > }
> > >
> > > + of_node_get(np_stcc);
> > > stc->cdev = tcd;
> > > stc->init = true;
> > > }
> >
> > Thanks for fixing this. However, I am wondering if it is better for the
> > 'of_node_get' to be placed within the
> > thermal_of_cooling_device_register() function as it seems a bit odd if
> > the caller needs to know that this is being stored for later use.
> >
> > Also, taking a quick look, I see a couple other drivers calling
> > thermal_of_cooling_device_register() and they are also not calling
> > of_node_get on success. So it maybe easier to fix placing it in the
> > thermal_of_cooling_device_register() function.
>
> I'm not an expert, but I had the impression that from some call sites, the
> get would have been done already, because the argument is already stored
> in some structure. I can check more exhaustively.
Julia, I agree with Jon here. Better if fixed in the API itself. Are you
still planning on sending a fix for this?
On Mon, 4 Dec 2017, Eduardo Valentin wrote:
> On Mon, Jul 17, 2017 at 04:42:38PM +0200, Julia Lawall wrote:
> >
> >
> > On Mon, 17 Jul 2017, Jon Hunter wrote:
> >
> > >
> > > On 15/07/17 09:42, Julia Lawall wrote:
> > > > Device node iterators perform an of_node_put on each iteration, so putting
> > > > an of_node_put before a continue results in a double put.
> > > >
> > > > The semantic match that finds this problem is as follows
> > > > (http://coccinelle.lip6.fr):
> > > >
> > > > // <smpl>
> > > > @@
> > > > expression e1;
> > > > local idexpression child;
> > > > iterator name for_each_child_of_node;
> > > > @@
> > > >
> > > > for_each_child_of_node(e1,child) {
> > > > ... when != of_node_get(child)
> > > > * of_node_put(child);
> > > > ...
> > > > * continue;
> > > > }
> > > > // </smpl>
> > > >
> > > > Furthermore, the call to thermal_of_cooling_device_register immediately
> > > > calls __thermal_cooling_device_register with the same arguments. The
> > > > latter function stores the device node argument, which is the second
> > > > argument of for_each_child_of_node, in the returned thermal_cooling_device
> > > > structure. This returned structure is then stored in the cdev field of
> > > > stc. Thus it seems that the second argument of for_each_child_of_node
> > > > escapes the scope of the for_each_child_of_node, so an explicit of_node_get
> > > > on success of thermal_of_cooling_device_register is also needed.
> > > >
> > > > Signed-off-by: Julia Lawall <[email protected]>
> > > >
> > > > ---
> > > > drivers/thermal/tegra/soctherm.c | 2 +-
> > > > 1 file changed, 1 insertion(+), 1 deletion(-)
> > > >
> > > > diff --git a/drivers/thermal/tegra/soctherm.c b/drivers/thermal/tegra/soctherm.c
> > > > index 7d2db23..10f4fdd 100644
> > > > --- a/drivers/thermal/tegra/soctherm.c
> > > > +++ b/drivers/thermal/tegra/soctherm.c
> > > > @@ -1014,7 +1014,6 @@ static void soctherm_init_hw_throt_cdev(struct platform_device *pdev)
> > > > tcd = thermal_of_cooling_device_register(np_stcc,
> > > > (char *)name, ts,
> > > > &throt_cooling_ops);
> > > > - of_node_put(np_stcc);
> > > > if (IS_ERR_OR_NULL(tcd)) {
> > > > dev_err(dev,
> > > > "throttle-cfg: %s: failed to register cooling device\n",
> > > > @@ -1022,6 +1021,7 @@ static void soctherm_init_hw_throt_cdev(struct platform_device *pdev)
> > > > continue;
> > > > }
> > > >
> > > > + of_node_get(np_stcc);
> > > > stc->cdev = tcd;
> > > > stc->init = true;
> > > > }
> > >
> > > Thanks for fixing this. However, I am wondering if it is better for the
> > > 'of_node_get' to be placed within the
> > > thermal_of_cooling_device_register() function as it seems a bit odd if
> > > the caller needs to know that this is being stored for later use.
> > >
> > > Also, taking a quick look, I see a couple other drivers calling
> > > thermal_of_cooling_device_register() and they are also not calling
> > > of_node_get on success. So it maybe easier to fix placing it in the
> > > thermal_of_cooling_device_register() function.
> >
> > I'm not an expert, but I had the impression that from some call sites, the
> > get would have been done already, because the argument is already stored
> > in some structure. I can check more exhaustively.
>
> Julia, I agree with Jon here. Better if fixed in the API itself. Are you
> still planning on sending a fix for this?
This has fallen off my stack, and I'mnot sure that Ican get to it in the
short term.
julia