diff options
| author |   Frank Rowand <frank.rowand@sony.com> | 2018-10-04 20:25:13 -0700 |
|---|---|---|
| committer | Frank Rowand <frank.rowand@sony.com> | 2018-11-08 22:10:44 -0800 |
| commit | 7c528e457d53c75107d5aa56892316d265c778de (patch) | |
| tree | 86ad863f9bad9cd06d0749a47bec79ad51bde96a /drivers/of | |
| parent | of: overlay: add tests to validate kfrees from overlay removal (diff) | |
| download | linux-dev-7c528e457d53c75107d5aa56892316d265c778de.tar.xz linux-dev-7c528e457d53c75107d5aa56892316d265c778de.zip | |
of: overlay: add missing of_node_put() after add new node to changeset
The refcount of a newly added overlay node decrements to one
(instead of zero) when the overlay changeset is destroyed. This
change will cause the final decrement be to zero.
After applying this patch, new validation warnings will be
reported from the devicetree unittest during boot due to
a pre-existing devicetree bug. The warnings will be similar to:
OF: ERROR: memory leak before free overlay changeset, /testcase-data/overlay-node/test-bus/test-unittest4
This pre-existing devicetree bug will also trigger a WARN_ONCE() from
refcount_sub_and_test_checked() when an overlay changeset is
destroyed without having first been applied. This scenario occurs
when an error in the overlay is detected during the overlay changeset
creation:
WARNING: CPU: 0 PID: 1 at lib/refcount.c:187 refcount_sub_and_test_checked+0xa8/0xbc
refcount_t: underflow; use-after-free.
(unwind_backtrace) from (show_stack+0x10/0x14)
(show_stack) from (dump_stack+0x6c/0x8c)
(dump_stack) from (__warn+0xdc/0x104)
(__warn) from (warn_slowpath_fmt+0x44/0x6c)
(warn_slowpath_fmt) from (refcount_sub_and_test_checked+0xa8/0xbc)
(refcount_sub_and_test_checked) from (kobject_put+0x24/0x208)
(kobject_put) from (of_changeset_destroy+0x2c/0xb4)
(of_changeset_destroy) from (free_overlay_changeset+0x1c/0x9c)
(free_overlay_changeset) from (of_overlay_remove+0x284/0x2cc)
(of_overlay_remove) from (of_unittest_apply_revert_overlay_check.constprop.4+0xf8/0x1e8)
(of_unittest_apply_revert_overlay_check.constprop.4) from (of_unittest_overlay+0x960/0xed8)
(of_unittest_overlay) from (of_unittest+0x1cc4/0x2138)
(of_unittest) from (do_one_initcall+0x4c/0x28c)
(do_one_initcall) from (kernel_init_freeable+0x29c/0x378)
(kernel_init_freeable) from (kernel_init+0x8/0x110)
(kernel_init) from (ret_from_fork+0x14/0x2c)
Tested-by: Alan Tull <atull@kernel.org>
Signed-off-by: Frank Rowand <frank.rowand@sony.com>
Diffstat (limited to 'drivers/of')
| -rw-r--r-- | drivers/of/overlay.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c index f5fc8859a7ee..7613f7d680c7 100644 --- a/drivers/of/overlay.c +++ b/drivers/of/overlay.c @@ -379,7 +379,9 @@ static int add_changeset_node(struct overlay_changeset *ovcs, if (ret) return ret; - return build_changeset_next_level(ovcs, tchild, node); + ret = build_changeset_next_level(ovcs, tchild, node); + of_node_put(tchild); + return ret; } if (node->phandle && tchild->phandle) |