Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Wed, 27 Feb 2019 09:25:19 +0100 (CET)
From:   Julia Lawall <julia.lawall@lip6.fr>
To:     Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
cc:     kishon@ti.com, linux-kernel@vger.kernel.org,
        linux-renesas-soc@vger.kernel.org
Subject: Re: [PATCH] phy: renesas: rcar-gen2: Fix memory leak at error
 paths
In-Reply-To: <1551250826-10302-1-git-send-email-yoshihiro.shimoda.uh@renesas.com>
Message-ID: <alpine.DEB.2.21.1902270920300.2671@hadrien>
References: <1551250826-10302-1-git-send-email-yoshihiro.shimoda.uh@renesas.com>
User-Agent: Alpine 2.21 (DEB 202 2017-01-01)
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


On Wed, 27 Feb 2019, Yoshihiro Shimoda wrote:

> This patch fixes memory leak at error paths of the probe function.
> In for_each_child_of_node, if the loop returns, the driver should
> call of_put_node() before returns.
>
> Reported-by: Julia Lawall <julia.lawall@lip6.fr>
> Fixes: 1233f59f745 ("phy: Renesas R-Car Gen2 PHY driver")
> Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
> ---
>  drivers/phy/renesas/phy-rcar-gen2.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/phy/renesas/phy-rcar-gen2.c b/drivers/phy/renesas/phy-rcar-gen2.c
> index 72eeb06..570b4e4 100644
> --- a/drivers/phy/renesas/phy-rcar-gen2.c
> +++ b/drivers/phy/renesas/phy-rcar-gen2.c
> @@ -285,6 +285,7 @@ static int rcar_gen2_phy_probe(struct platform_device *pdev)
>  		error = of_property_read_u32(np, "reg", &channel_num);
>  		if (error || channel_num > 2) {
>  			dev_err(dev, "Invalid \"reg\" property\n");
> +			of_node_put(np);
>  			return error;
>  		}
>  		channel->select_mask = select_mask[channel_num];
> @@ -300,6 +301,7 @@ static int rcar_gen2_phy_probe(struct platform_device *pdev)
>  						   &rcar_gen2_phy_ops);
>  			if (IS_ERR(phy->phy)) {
>  				dev_err(dev, "Failed to create PHY\n");
> +				of_node_put(np);
>  				return PTR_ERR(phy->phy);
>  			}
>  			phy_set_drvdata(phy->phy, phy);

Hello,

I was concerned about the assignment channel->of_node = np;.  Because
channels is allocated with a devm function, it will get freed on an error
return, so this pointer doesn't matter.  But don't you need an of_node_get
on this assignment?  Does the fact that you haven't seen a problem with
this in testing mean that the field is actually never accessed?

julia