2022-05-12 12:48:18

by Miaoqian Lin

Subject: [PATCH] powerpc/xive: Fix refcount leak in xive_spapr_init

of_find_compatible_node() returns a node pointer with refcount
incremented, we should use of_node_put() on it when done.
Add missing of_node_put() to avoid refcount leak.

Fixes: eac1e731b59e ("powerpc/xive: guest exploitation of the XIVE interrupt controller")
Signed-off-by: Miaoqian Lin <[email protected]>
---
arch/powerpc/sysdev/xive/spapr.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c
index 29456c255f9f..503f544d28e2 100644
--- a/arch/powerpc/sysdev/xive/spapr.c
+++ b/arch/powerpc/sysdev/xive/spapr.c
@@ -830,12 +830,12 @@ bool __init xive_spapr_init(void)
/* Resource 1 is the OS ring TIMA */
if (of_address_to_resource(np, 1, &r)) {
pr_err("Failed to get thread mgmnt area resource\n");
- return false;
+ goto err_put;
}
tima = ioremap(r.start, resource_size(&r));
if (!tima) {
pr_err("Failed to map thread mgmnt area\n");
- return false;
+ goto err_put;
}

if (!xive_get_max_prio(&max_prio))
@@ -871,6 +871,7 @@ bool __init xive_spapr_init(void)
if (!xive_core_init(np, &xive_spapr_ops, tima, TM_QW1_OS, max_prio))
goto err_mem_free;

+ of_node_put(np);
pr_info("Using %dkB queues\n", 1 << (xive_queue_shift - 10));
return true;

@@ -878,6 +879,8 @@ bool __init xive_spapr_init(void)
xive_irq_bitmap_remove_all();
err_unmap:
iounmap(tima);
+err_put:
+ of_node_put(np);
return false;
}

--
2.25.1

2022-05-13 14:27:36

by Cédric Le Goater

Subject: Re: [PATCH] powerpc/xive: Fix refcount leak in xive_spapr_init

On 5/12/22 11:05, Miaoqian Lin wrote:
> of_find_compatible_node() returns a node pointer with refcount
> incremented, we should use of_node_put() on it when done.
> Add missing of_node_put() to avoid refcount leak.
>
> Fixes: eac1e731b59e ("powerpc/xive: guest exploitation of the XIVE interrupt controller")
> Signed-off-by: Miaoqian Lin <[email protected]>

Reviewed-by: Cédric Le Goater <[email protected]>

Thanks,

C.

> ---
> arch/powerpc/sysdev/xive/spapr.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c
> index 29456c255f9f..503f544d28e2 100644
> --- a/arch/powerpc/sysdev/xive/spapr.c
> +++ b/arch/powerpc/sysdev/xive/spapr.c
> @@ -830,12 +830,12 @@ bool __init xive_spapr_init(void)
> /* Resource 1 is the OS ring TIMA */
> if (of_address_to_resource(np, 1, &r)) {
> pr_err("Failed to get thread mgmnt area resource\n");
> - return false;
> + goto err_put;
> }
> tima = ioremap(r.start, resource_size(&r));
> if (!tima) {
> pr_err("Failed to map thread mgmnt area\n");
> - return false;
> + goto err_put;
> }
>
> if (!xive_get_max_prio(&max_prio))
> @@ -871,6 +871,7 @@ bool __init xive_spapr_init(void)
> if (!xive_core_init(np, &xive_spapr_ops, tima, TM_QW1_OS, max_prio))
> goto err_mem_free;
>
> + of_node_put(np);
> pr_info("Using %dkB queues\n", 1 << (xive_queue_shift - 10));
> return true;
>
> @@ -878,6 +879,8 @@ bool __init xive_spapr_init(void)
> xive_irq_bitmap_remove_all();
> err_unmap:
> iounmap(tima);
> +err_put:
> + of_node_put(np);
> return false;
> }
>