On Tue, Jan 07, 2025 at 05:18:23PM +0900, Joe Hattori wrote:
> qcom_smd_register_edge() leaks an OF node reference when
> qcom_smd_create_chrdev() fails, since qcom_smd_parse_edge() sets
> of_node_get(node) to edge->of_node. Add of_node_put() calls to the error
> path of qcom_smd_register_edge() and qcom_smd_unregister_edge().
>
> This was found by an experimental verifier that I am developing. Due to
> the lack of actual devices, no runtime test was able to be performed.
>
> Fixes: 53e2822e56c7 ("rpmsg: Introduce Qualcomm SMD backend")
> Signed-off-by: Joe Hattori <joe@xxxxxxxxxxxxxxxxxxxxx>
> ---
> drivers/rpmsg/qcom_smd.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c
> index 40d386809d6b..6982015b218d 100644
> --- a/drivers/rpmsg/qcom_smd.c
> +++ b/drivers/rpmsg/qcom_smd.c
> @@ -1509,13 +1509,15 @@ struct qcom_smd_edge *qcom_smd_register_edge(struct device *parent,
> ret = qcom_smd_create_chrdev(edge);
> if (ret) {
> dev_err(&edge->dev, "failed to register chrdev for edge\n");
> - goto unregister_dev;
> + goto put_node;
> }
>
> schedule_work(&edge->scan_work);
>
> return edge;
>
> +put_node:
> + of_node_put(node);
please put edge->of_node to make it more obvious what is happening.
> unregister_dev:
> if (!IS_ERR_OR_NULL(edge->mbox_chan))
> mbox_free_channel(edge->mbox_chan);
> @@ -1548,6 +1550,7 @@ void qcom_smd_unregister_edge(struct qcom_smd_edge *edge)
> if (ret)
> dev_warn(&edge->dev, "can't remove smd device: %d\n", ret);
>
> + of_node_put(edge->of_node);
> mbox_free_channel(edge->mbox_chan);
> device_unregister(&edge->dev);
> }
> --
> 2.34.1
>
--
With best wishes
Dmitry
