From: Luca Ceresoli <[email protected]>
At probe time this code path is followed:
* tegra_csi_init
* tegra_csi_channels_alloc
* for_each_child_of_node(node, channel) -- iterates over channels
* automatically gets 'channel'
* tegra_csi_channel_alloc()
* saves into chan->of_node a pointer to the channel OF node
* automatically gets and puts 'channel'
* now the node saved in chan->of_node has refcount 0, can disappear
* tegra_csi_channels_init
* iterates over channels
* tegra_csi_channel_init -- uses chan->of_node
After that, chan->of_node keeps storing the node until the device is
removed.
of_node_get() the node and of_node_put() it during teardown to avoid any
risk.
Fixes: 1ebaeb09830f ("media: tegra-video: Add support for external sensor capture")
Cc: [email protected]
Cc: Sowjanya Komatineni <[email protected]>
Signed-off-by: Luca Ceresoli <[email protected]>
---
drivers/staging/media/tegra-video/csi.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/media/tegra-video/csi.c b/drivers/staging/media/tegra-video/csi.c
index b26e44adb2be..1b05f620b476 100644
--- a/drivers/staging/media/tegra-video/csi.c
+++ b/drivers/staging/media/tegra-video/csi.c
@@ -433,7 +433,7 @@ static int tegra_csi_channel_alloc(struct tegra_csi *csi,
for (i = 0; i < chan->numgangports; i++)
chan->csi_port_nums[i] = port_num + i * CSI_PORTS_PER_BRICK;
- chan->of_node = node;
+ chan->of_node = of_node_get(node);
chan->numpads = num_pads;
if (num_pads & 0x2) {
chan->pads[0].flags = MEDIA_PAD_FL_SINK;
@@ -640,6 +640,7 @@ static void tegra_csi_channels_cleanup(struct tegra_csi *csi)
media_entity_cleanup(&subdev->entity);
}
+ of_node_put(chan->of_node);
list_del(&chan->list);
kfree(chan);
}
--
2.34.1
On Fri, Oct 28, 2022 at 10:19:26AM +0200, [email protected] wrote:
> From: Luca Ceresoli <[email protected]>
>
> At probe time this code path is followed:
>
> * tegra_csi_init
> * tegra_csi_channels_alloc
> * for_each_child_of_node(node, channel) -- iterates over channels
> * automatically gets 'channel'
> * tegra_csi_channel_alloc()
> * saves into chan->of_node a pointer to the channel OF node
> * automatically gets and puts 'channel'
> * now the node saved in chan->of_node has refcount 0, can disappear
> * tegra_csi_channels_init
> * iterates over channels
> * tegra_csi_channel_init -- uses chan->of_node
>
> After that, chan->of_node keeps storing the node until the device is
> removed.
>
> of_node_get() the node and of_node_put() it during teardown to avoid any
> risk.
>
> Fixes: 1ebaeb09830f ("media: tegra-video: Add support for external sensor capture")
> Cc: [email protected]
> Cc: Sowjanya Komatineni <[email protected]>
> Signed-off-by: Luca Ceresoli <[email protected]>
> ---
> drivers/staging/media/tegra-video/csi.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/staging/media/tegra-video/csi.c b/drivers/staging/media/tegra-video/csi.c
> index b26e44adb2be..1b05f620b476 100644
> --- a/drivers/staging/media/tegra-video/csi.c
> +++ b/drivers/staging/media/tegra-video/csi.c
> @@ -433,7 +433,7 @@ static int tegra_csi_channel_alloc(struct tegra_csi *csi,
> for (i = 0; i < chan->numgangports; i++)
> chan->csi_port_nums[i] = port_num + i * CSI_PORTS_PER_BRICK;
>
> - chan->of_node = node;
> + chan->of_node = of_node_get(node);
> chan->numpads = num_pads;
> if (num_pads & 0x2) {
> chan->pads[0].flags = MEDIA_PAD_FL_SINK;
> @@ -640,6 +640,7 @@ static void tegra_csi_channels_cleanup(struct tegra_csi *csi)
> media_entity_cleanup(&subdev->entity);
> }
>
> + of_node_put(chan->of_node);
> list_del(&chan->list);
> kfree(chan);
Not related to your patch, but this kind of "one function cleans up
everything" style is always buggy. For example, here it should be:
- if (chan->mipi)
+ if (!IS_ERR_OR_NULL(chan->mipi))
tegra_mipi_free(chan->mipi);
regards,
dan carpenter
Hello Dan,
On Fri, 28 Oct 2022 15:34:39 +0300
Dan Carpenter <[email protected]> wrote:
> On Fri, Oct 28, 2022 at 10:19:26AM +0200, [email protected] wrote:
> > From: Luca Ceresoli <[email protected]>
> >
> > At probe time this code path is followed:
> >
> > * tegra_csi_init
> > * tegra_csi_channels_alloc
> > * for_each_child_of_node(node, channel) -- iterates over channels
> > * automatically gets 'channel'
> > * tegra_csi_channel_alloc()
> > * saves into chan->of_node a pointer to the channel OF node
> > * automatically gets and puts 'channel'
> > * now the node saved in chan->of_node has refcount 0, can disappear
> > * tegra_csi_channels_init
> > * iterates over channels
> > * tegra_csi_channel_init -- uses chan->of_node
> >
> > After that, chan->of_node keeps storing the node until the device is
> > removed.
> >
> > of_node_get() the node and of_node_put() it during teardown to avoid any
> > risk.
> >
> > Fixes: 1ebaeb09830f ("media: tegra-video: Add support for external sensor capture")
> > Cc: [email protected]
> > Cc: Sowjanya Komatineni <[email protected]>
> > Signed-off-by: Luca Ceresoli <[email protected]>
> > ---
> > drivers/staging/media/tegra-video/csi.c | 3 ++-
> > 1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/staging/media/tegra-video/csi.c b/drivers/staging/media/tegra-video/csi.c
> > index b26e44adb2be..1b05f620b476 100644
> > --- a/drivers/staging/media/tegra-video/csi.c
> > +++ b/drivers/staging/media/tegra-video/csi.c
> > @@ -433,7 +433,7 @@ static int tegra_csi_channel_alloc(struct tegra_csi *csi,
> > for (i = 0; i < chan->numgangports; i++)
> > chan->csi_port_nums[i] = port_num + i * CSI_PORTS_PER_BRICK;
> >
> > - chan->of_node = node;
> > + chan->of_node = of_node_get(node);
> > chan->numpads = num_pads;
> > if (num_pads & 0x2) {
> > chan->pads[0].flags = MEDIA_PAD_FL_SINK;
> > @@ -640,6 +640,7 @@ static void tegra_csi_channels_cleanup(struct tegra_csi *csi)
> > media_entity_cleanup(&subdev->entity);
> > }
> >
> > + of_node_put(chan->of_node);
> > list_del(&chan->list);
> > kfree(chan);
>
> Not related to your patch, but this kind of "one function cleans up
> everything" style is always buggy. For example, here it should be:
>
> - if (chan->mipi)
> + if (!IS_ERR_OR_NULL(chan->mipi))
> tegra_mipi_free(chan->mipi);
I sort of agree the code could be clearer here, but looking at the code
in detail, this cannot happen. chan->mipi is set in one place only, and
if it is an error the whole probe fails. So it can be either NULL or a
valid pointer here.
Regarding my patch, do you think it is valid?
Best regards.
--
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
On Fri, Oct 28, 2022 at 06:58:47PM +0200, Luca Ceresoli wrote:
> Hello Dan,
>
> On Fri, 28 Oct 2022 15:34:39 +0300
> Dan Carpenter <[email protected]> wrote:
>
> > On Fri, Oct 28, 2022 at 10:19:26AM +0200, [email protected] wrote:
> > > From: Luca Ceresoli <[email protected]>
> > >
> > > At probe time this code path is followed:
> > >
> > > * tegra_csi_init
> > > * tegra_csi_channels_alloc
> > > * for_each_child_of_node(node, channel) -- iterates over channels
> > > * automatically gets 'channel'
> > > * tegra_csi_channel_alloc()
> > > * saves into chan->of_node a pointer to the channel OF node
> > > * automatically gets and puts 'channel'
> > > * now the node saved in chan->of_node has refcount 0, can disappear
> > > * tegra_csi_channels_init
> > > * iterates over channels
> > > * tegra_csi_channel_init -- uses chan->of_node
> > >
> > > After that, chan->of_node keeps storing the node until the device is
> > > removed.
> > >
> > > of_node_get() the node and of_node_put() it during teardown to avoid any
> > > risk.
> > >
> > > Fixes: 1ebaeb09830f ("media: tegra-video: Add support for external sensor capture")
> > > Cc: [email protected]
> > > Cc: Sowjanya Komatineni <[email protected]>
> > > Signed-off-by: Luca Ceresoli <[email protected]>
> > > ---
> > > drivers/staging/media/tegra-video/csi.c | 3 ++-
> > > 1 file changed, 2 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/staging/media/tegra-video/csi.c b/drivers/staging/media/tegra-video/csi.c
> > > index b26e44adb2be..1b05f620b476 100644
> > > --- a/drivers/staging/media/tegra-video/csi.c
> > > +++ b/drivers/staging/media/tegra-video/csi.c
> > > @@ -433,7 +433,7 @@ static int tegra_csi_channel_alloc(struct tegra_csi *csi,
> > > for (i = 0; i < chan->numgangports; i++)
> > > chan->csi_port_nums[i] = port_num + i * CSI_PORTS_PER_BRICK;
> > >
> > > - chan->of_node = node;
> > > + chan->of_node = of_node_get(node);
> > > chan->numpads = num_pads;
> > > if (num_pads & 0x2) {
> > > chan->pads[0].flags = MEDIA_PAD_FL_SINK;
> > > @@ -640,6 +640,7 @@ static void tegra_csi_channels_cleanup(struct tegra_csi *csi)
> > > media_entity_cleanup(&subdev->entity);
> > > }
> > >
> > > + of_node_put(chan->of_node);
> > > list_del(&chan->list);
> > > kfree(chan);
> >
> > Not related to your patch, but this kind of "one function cleans up
> > everything" style is always buggy. For example, here it should be:
> >
> > - if (chan->mipi)
> > + if (!IS_ERR_OR_NULL(chan->mipi))
> > tegra_mipi_free(chan->mipi);
>
> I sort of agree the code could be clearer here, but looking at the code
> in detail, this cannot happen. chan->mipi is set in one place only, and
> if it is an error the whole probe fails. So it can be either NULL or a
> valid pointer here.
I assumed that tegra_csi_channels_cleanup() would clean up if
tegra_csi_channel_alloc() fails. Otherwise then that's several
different even worse bugs.
HINT: Let's all hope my initial analysis was correct.
>
> Regarding my patch, do you think it is valid?
It sort of depends on if the "chan->mipi" dereference can crash like I
explained above. If there is no ->mipi crash then the error handling
needs to be fixed.
regards,
dan carpenter
Hello Dan,
On Fri, 28 Oct 2022 20:06:34 +0300
Dan Carpenter <[email protected]> wrote:
> On Fri, Oct 28, 2022 at 06:58:47PM +0200, Luca Ceresoli wrote:
> > Hello Dan,
> >
> > On Fri, 28 Oct 2022 15:34:39 +0300
> > Dan Carpenter <[email protected]> wrote:
> >
> > > On Fri, Oct 28, 2022 at 10:19:26AM +0200, [email protected] wrote:
> > > > From: Luca Ceresoli <[email protected]>
> > > >
> > > > At probe time this code path is followed:
> > > >
> > > > * tegra_csi_init
> > > > * tegra_csi_channels_alloc
> > > > * for_each_child_of_node(node, channel) -- iterates over channels
> > > > * automatically gets 'channel'
> > > > * tegra_csi_channel_alloc()
> > > > * saves into chan->of_node a pointer to the channel OF node
> > > > * automatically gets and puts 'channel'
> > > > * now the node saved in chan->of_node has refcount 0, can disappear
> > > > * tegra_csi_channels_init
> > > > * iterates over channels
> > > > * tegra_csi_channel_init -- uses chan->of_node
> > > >
> > > > After that, chan->of_node keeps storing the node until the device is
> > > > removed.
> > > >
> > > > of_node_get() the node and of_node_put() it during teardown to avoid any
> > > > risk.
> > > >
> > > > Fixes: 1ebaeb09830f ("media: tegra-video: Add support for external sensor capture")
> > > > Cc: [email protected]
> > > > Cc: Sowjanya Komatineni <[email protected]>
> > > > Signed-off-by: Luca Ceresoli <[email protected]>
> > > > ---
> > > > drivers/staging/media/tegra-video/csi.c | 3 ++-
> > > > 1 file changed, 2 insertions(+), 1 deletion(-)
> > > >
> > > > diff --git a/drivers/staging/media/tegra-video/csi.c b/drivers/staging/media/tegra-video/csi.c
> > > > index b26e44adb2be..1b05f620b476 100644
> > > > --- a/drivers/staging/media/tegra-video/csi.c
> > > > +++ b/drivers/staging/media/tegra-video/csi.c
> > > > @@ -433,7 +433,7 @@ static int tegra_csi_channel_alloc(struct tegra_csi *csi,
> > > > for (i = 0; i < chan->numgangports; i++)
> > > > chan->csi_port_nums[i] = port_num + i * CSI_PORTS_PER_BRICK;
> > > >
> > > > - chan->of_node = node;
> > > > + chan->of_node = of_node_get(node);
> > > > chan->numpads = num_pads;
> > > > if (num_pads & 0x2) {
> > > > chan->pads[0].flags = MEDIA_PAD_FL_SINK;
> > > > @@ -640,6 +640,7 @@ static void tegra_csi_channels_cleanup(struct tegra_csi *csi)
> > > > media_entity_cleanup(&subdev->entity);
> > > > }
> > > >
> > > > + of_node_put(chan->of_node);
> > > > list_del(&chan->list);
> > > > kfree(chan);
> > >
> > > Not related to your patch, but this kind of "one function cleans up
> > > everything" style is always buggy. For example, here it should be:
> > >
> > > - if (chan->mipi)
> > > + if (!IS_ERR_OR_NULL(chan->mipi))
> > > tegra_mipi_free(chan->mipi);
> >
> > I sort of agree the code could be clearer here, but looking at the code
> > in detail, this cannot happen. chan->mipi is set in one place only, and
> > if it is an error the whole probe fails. So it can be either NULL or a
> > valid pointer here.
>
> I assumed that tegra_csi_channels_cleanup() would clean up if
> tegra_csi_channel_alloc() fails. Otherwise then that's several
> different even worse bugs.
>
> HINT: Let's all hope my initial analysis was correct.
Indeed you have a point. Apologies for having replied in a hurry and for
the resulting noise.
I'm going to send a patch to fix the chan->mipi mess. However I think
the best way to do so would be a oneliner:
@@ -491,6 +491,7 @@ static int tegra_csi_channel_alloc(struct tegra_csi *csi,
chan->mipi = tegra_mipi_request(csi->dev, node);
if (IS_ERR(chan->mipi)) {
ret = PTR_ERR(chan->mipi);
+ chan->mipi = NULL;
dev_err(csi->dev, "failed to get mipi device: %d\n", ret);
}
This would be a correct implementation of the initial intent as it can
be inferred from the code, i.e. chan->mipi being either NULL or a valid
pointer. This makes sense as chan->mipi is assigned in a single place.
--
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com