Re:Re: [PATCH] gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data()

["Liang He" <windhl@xxxxxxx>]

At 2022-07-05 23:40:12, "Bartosz Golaszewski" <brgl@xxxxxxxx> wrote:
>On Mon, Jul 4, 2022 at 11:13 AM Liang He <windhl@xxxxxxx> wrote:
>>
>> We should use of_node_get() when a new reference of device_node
>> is created. It is noted that the old reference stored in
>> 'mm_gc->gc.of_node' should also be decreased.
>>
>> Fixes: f141ed65f256 ("gpio: Move DT support code into drivers/gpio")
>> Signed-off-by: Liang He <windhl@xxxxxxx>
>> ---
>>  drivers/gpio/gpiolib-of.c | 4 +++-
>>  1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
>> index 3d6c3ffd5576..de100b0217da 100644
>> --- a/drivers/gpio/gpiolib-of.c
>> +++ b/drivers/gpio/gpiolib-of.c
>> @@ -860,7 +860,8 @@ int of_mm_gpiochip_add_data(struct device_node *np,
>>         if (mm_gc->save_regs)
>>                 mm_gc->save_regs(mm_gc);
>>
>> -       mm_gc->gc.of_node = np;
>> +       of_node_put(mm_gc->gc.of_node);
>> +       mm_gc->gc.of_node = of_node_get(np);
>>
>>         ret = gpiochip_add_data(gc, data);
>>         if (ret)
>> @@ -868,6 +869,7 @@ int of_mm_gpiochip_add_data(struct device_node *np,
>>
>>         return 0;
>>  err2:
>> +       of_node_put(np);
>>         iounmap(mm_gc->regs);
>>  err1:
>>         kfree(gc->label);
>> --
>> 2.25.1
>>
>
>Have you noticed any issue with reference counting that made you post
>this patch? We typically "borrow" the reference to the platform
>device's of_node in GPIO drivers (and everywhere I can think of too).
>
>Bart

Hi, Bart.

This patch is based on the fact that there is a call site in function 'qe_add_gpiochips()'
of src file 'drivers\soc\fsl\qe\gpio.c'.

In that function, of_mm_gpiochip_add_data() is contained in a iteration of for_each_compatible_node(),
which will automatically increase and decrease the refcount.

As there is a new reference escaped into the mm_gc->gc.of_node, we should increase the 
refcount, otherwise, there may be a premature free as we do not know the existence of
the reference in 'mm_gc->gc.of_node'.

If my understanding is wrong, please correct me.

Thanks,

Liang