2019-03-25 17:39:52

by Steven Price

[permalink] [raw]
Subject: [PATCH] firmware: arm_scmi: Fix leak in scmi_mailbox_check

of_parse_phandle_with_args() requires the caller to call of_node_put() on
the returned args->np pointer. Otherwise the reference count will remain
incremented.

However, in this case, since we don't actually use the returned pointer,
we can simply pass in NULL.

Fixes: aa4f886f3893f ("firmware: arm_scmi: add basic driver infrastructure for SCMI")
Signed-off-by: Steven Price <[email protected]>
---
drivers/firmware/arm_scmi/driver.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
index 8f952f2f1a29..dd967d675c08 100644
--- a/drivers/firmware/arm_scmi/driver.c
+++ b/drivers/firmware/arm_scmi/driver.c
@@ -654,9 +654,7 @@ static int scmi_xfer_info_init(struct scmi_info *sinfo)

static int scmi_mailbox_check(struct device_node *np)
{
- struct of_phandle_args arg;
-
- return of_parse_phandle_with_args(np, "mboxes", "#mbox-cells", 0, &arg);
+ return of_parse_phandle_with_args(np, "mboxes", "#mbox-cells", 0, NULL);
}

static int scmi_mbox_free_channel(int id, void *p, void *data)
--
2.20.1



2019-03-26 07:24:43

by Mukesh Ojha

[permalink] [raw]
Subject: Re: [PATCH] firmware: arm_scmi: Fix leak in scmi_mailbox_check


On 3/25/2019 11:07 PM, Steven Price wrote:
> of_parse_phandle_with_args() requires the caller to call of_node_put() on
> the returned args->np pointer. Otherwise the reference count will remain
> incremented.
>
> However, in this case, since we don't actually use the returned pointer,
> we can simply pass in NULL.
>
> Fixes: aa4f886f3893f ("firmware: arm_scmi: add basic driver infrastructure for SCMI")
> Signed-off-by: Steven Price <[email protected]>
> ---
> drivers/firmware/arm_scmi/driver.c | 4 +---
> 1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
> index 8f952f2f1a29..dd967d675c08 100644
> --- a/drivers/firmware/arm_scmi/driver.c
> +++ b/drivers/firmware/arm_scmi/driver.c
> @@ -654,9 +654,7 @@ static int scmi_xfer_info_init(struct scmi_info *sinfo)
>
> static int scmi_mailbox_check(struct device_node *np)
> {
> - struct of_phandle_args arg;
> -
> - return of_parse_phandle_with_args(np, "mboxes", "#mbox-cells", 0, &arg);
> + return of_parse_phandle_with_args(np, "mboxes", "#mbox-cells", 0, NULL);

Although, it is not used but it is better to put arg->np instead of
passing NULL.
Here, you are making the driver not to fill arguement which is
customised solution, that may change in future.


Thanks.
Mukesh


> }
>
> static int scmi_mbox_free_channel(int id, void *p, void *data)

2019-03-26 12:00:09

by Steven Price

[permalink] [raw]
Subject: Re: [PATCH] firmware: arm_scmi: Fix leak in scmi_mailbox_check

On 26/03/2019 07:23, Mukesh Ojha wrote:
>
> On 3/25/2019 11:07 PM, Steven Price wrote:
>> of_parse_phandle_with_args() requires the caller to call of_node_put() on
>> the returned args->np pointer. Otherwise the reference count will remain
>> incremented.
>>
>> However, in this case, since we don't actually use the returned pointer,
>> we can simply pass in NULL.
>>
>> Fixes: aa4f886f3893f ("firmware: arm_scmi: add basic driver
>> infrastructure for SCMI")
>> Signed-off-by: Steven Price <[email protected]>
>> ---
>>   drivers/firmware/arm_scmi/driver.c | 4 +---
>>   1 file changed, 1 insertion(+), 3 deletions(-)
>>
>> diff --git a/drivers/firmware/arm_scmi/driver.c
>> b/drivers/firmware/arm_scmi/driver.c
>> index 8f952f2f1a29..dd967d675c08 100644
>> --- a/drivers/firmware/arm_scmi/driver.c
>> +++ b/drivers/firmware/arm_scmi/driver.c
>> @@ -654,9 +654,7 @@ static int scmi_xfer_info_init(struct scmi_info
>> *sinfo)
>>     static int scmi_mailbox_check(struct device_node *np)
>>   {
>> -    struct of_phandle_args arg;
>> -
>> -    return of_parse_phandle_with_args(np, "mboxes", "#mbox-cells", 0,
>> &arg);
>> +    return of_parse_phandle_with_args(np, "mboxes", "#mbox-cells", 0,
>> NULL);
>
> Although, it is not used but it is better to put arg->np instead of
> passing NULL.
> Here, you are making the driver not to fill arguement which is
> customised solution, that may change in future.

The function of_parse_phandle_with_args() is documented thus:

> * of_parse_phandle_with_args() - Find a node pointed by phandle in a list
> * @np: pointer to a device tree node containing a list
> * @list_name: property name that contains a list
> * @cells_name: property name that specifies phandles' arguments count
> * @index: index of a phandle to parse out
> * @out_args: optional pointer to output arguments structure (will be filled)

So I'm going by the documentation (and implementation) which both
consider out_args to be optional. The alternative is of course:

> diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
> index 8f952f2f1a29..aa6c0728e676 100644
> --- a/drivers/firmware/arm_scmi/driver.c
> +++ b/drivers/firmware/arm_scmi/driver.c
> @@ -655,8 +655,11 @@ static int scmi_xfer_info_init(struct scmi_info *sinfo)
> static int scmi_mailbox_check(struct device_node *np)
> {
> struct of_phandle_args arg;
> + int ret;
>
> - return of_parse_phandle_with_args(np, "mboxes", "#mbox-cells", 0, &arg);
> + ret = of_parse_phandle_with_args(np, "mboxes", "#mbox-cells", 0, &arg);
> + of_node_put(arg->np);
> + return ret;
> }
>
> static int scmi_mbox_free_channel(int id, void *p, void *data)

But personally that doesn't seem as good. Is there any reason to think
the interface of of_parse_phandle_with_args() will change?

Steve

2019-04-10 18:24:01

by Sudeep Holla

[permalink] [raw]
Subject: Re: [PATCH] firmware: arm_scmi: Fix leak in scmi_mailbox_check

On Mon, Mar 25, 2019 at 05:37:22PM +0000, Steven Price wrote:
> of_parse_phandle_with_args() requires the caller to call of_node_put() on
> the returned args->np pointer. Otherwise the reference count will remain
> incremented.
>

Good find and thanks for the fix.

> However, in this case, since we don't actually use the returned pointer,
> we can simply pass in NULL.
>
> Fixes: aa4f886f3893f ("firmware: arm_scmi: add basic driver infrastructure for SCMI")
> Signed-off-by: Steven Price <[email protected]>

Applied.

--
Regards,
Sudeep