On Fri, 10 Jun 2022 10:45:31 +0200
Nuno Sá <nuno.sa@xxxxxxxxxx> wrote:
Typo in patch title (just noticed whilst scrolling past)
release
> 'of_node_put()' can potentially release the memory pointed to by
> 'iiospec.np' which would leave us with an invalid pointer (and we would
> still pass it in 'of_xlate()'). As such, we can only release the node
> after we are done with it.
>
> Fixes: 17d82b47a215d ("iio: Add OF support")
> Signed-off-by: Nuno Sá <nuno.sa@xxxxxxxxxx>
> ---
> drivers/iio/inkern.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
> index df74765d33dc..9d87057794fc 100644
> --- a/drivers/iio/inkern.c
> +++ b/drivers/iio/inkern.c
> @@ -165,9 +165,10 @@ static int __of_iio_channel_get(struct iio_channel *channel,
>
> idev = bus_find_device(&iio_bus_type, NULL, iiospec.np,
> iio_dev_node_match);
> - of_node_put(iiospec.np);
> - if (idev == NULL)
> + if (idev == NULL) {
> + of_node_put(iiospec.np);
> return -EPROBE_DEFER;
> + }
>
> indio_dev = dev_to_iio_dev(idev);
> channel->indio_dev = indio_dev;
> @@ -175,6 +176,7 @@ static int __of_iio_channel_get(struct iio_channel *channel,
> index = indio_dev->info->of_xlate(indio_dev, &iiospec);
> else
> index = __of_iio_simple_xlate(indio_dev, &iiospec);
> + of_node_put(iiospec.np);
> if (index < 0)
> goto err_put;
> channel->channel = &indio_dev->channels[index];
