| Message ID | 20190808074720.15754-1-nishkadg.linux@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | pinctrl: freescale: imx: Add of_node_put() before return | expand |
On Thu, 2019-08-08 at 13:17 +0530, Nishka Dasgupta wrote: > Each iteration of for_each_child_of_node() puts the previous node; > however, in the case of a return from the middle of the loop, there is no > put, thus causing a memory leak. Hence put of_node_put() statements as > required before two mid-loop return statements. > Issue found with Coccinelle. > > Signed-off-by: Nishka Dasgupta <nishkadg.linux@gmail.com> > --- > drivers/pinctrl/freescale/pinctrl-imx.c | 13 ++++++++++--- > 1 file changed, 10 insertions(+), 3 deletions(-) > > diff --git a/drivers/pinctrl/freescale/pinctrl-imx.c b/drivers/pinctrl/freescale/pinctrl-imx.c > index 83ff9532bae6..9f42036c5fbb 100644 > --- a/drivers/pinctrl/freescale/pinctrl-imx.c > +++ b/drivers/pinctrl/freescale/pinctrl-imx.c > @@ -672,8 +672,10 @@ static int imx_pinctrl_parse_functions(struct device_node *np, > > grp = devm_kzalloc(ipctl->dev, sizeof(struct group_desc), > GFP_KERNEL); This looks to me like it could just allocate an array of struct group_desc upfront, just like the group_names array. Same for the functions in imx_pinctrl_probe_dt(). Not an issue with this patch though. Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> regards Philipp > - if (!grp) > + if (!grp) { > + of_node_put(child); > return -ENOMEM; > + } > > mutex_lock(&ipctl->mutex); > radix_tree_insert(&pctl->pin_group_tree, > @@ -697,12 +699,17 @@ static bool imx_pinctrl_dt_is_flat_functions(struct device_node *np) > struct device_node *pinctrl_np; > > for_each_child_of_node(np, function_np) { > - if (of_property_read_bool(function_np, "fsl,pins")) > + if (of_property_read_bool(function_np, "fsl,pins")) { > + of_node_put(function_np); > return true; > + } > > for_each_child_of_node(function_np, pinctrl_np) { > - if (of_property_read_bool(pinctrl_np, "fsl,pins")) > + if (of_property_read_bool(pinctrl_np, "fsl,pins")) { > + of_node_put(pinctrl_np); > + of_node_put(function_np); > return false; > + } > } > } >
On Thu, Aug 8, 2019 at 9:47 AM Nishka Dasgupta <nishkadg.linux@gmail.com> wrote: > Each iteration of for_each_child_of_node() puts the previous node; > however, in the case of a return from the middle of the loop, there is no > put, thus causing a memory leak. Hence put of_node_put() statements as > required before two mid-loop return statements. > Issue found with Coccinelle. > > Signed-off-by: Nishka Dasgupta <nishkadg.linux@gmail.com> Patch applied with Philipp's ACK. Yours, Linus Walleij
diff --git a/drivers/pinctrl/freescale/pinctrl-imx.c b/drivers/pinctrl/freescale/pinctrl-imx.c index 83ff9532bae6..9f42036c5fbb 100644 --- a/drivers/pinctrl/freescale/pinctrl-imx.c +++ b/drivers/pinctrl/freescale/pinctrl-imx.c @@ -672,8 +672,10 @@ static int imx_pinctrl_parse_functions(struct device_node *np, grp = devm_kzalloc(ipctl->dev, sizeof(struct group_desc), GFP_KERNEL); - if (!grp) + if (!grp) { + of_node_put(child); return -ENOMEM; + } mutex_lock(&ipctl->mutex); radix_tree_insert(&pctl->pin_group_tree, @@ -697,12 +699,17 @@ static bool imx_pinctrl_dt_is_flat_functions(struct device_node *np) struct device_node *pinctrl_np; for_each_child_of_node(np, function_np) { - if (of_property_read_bool(function_np, "fsl,pins")) + if (of_property_read_bool(function_np, "fsl,pins")) { + of_node_put(function_np); return true; + } for_each_child_of_node(function_np, pinctrl_np) { - if (of_property_read_bool(pinctrl_np, "fsl,pins")) + if (of_property_read_bool(pinctrl_np, "fsl,pins")) { + of_node_put(pinctrl_np); + of_node_put(function_np); return false; + } } }
Each iteration of for_each_child_of_node() puts the previous node; however, in the case of a return from the middle of the loop, there is no put, thus causing a memory leak. Hence put of_node_put() statements as required before two mid-loop return statements. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta <nishkadg.linux@gmail.com> --- drivers/pinctrl/freescale/pinctrl-imx.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)