On Tue, Nov 14, 2023 at 03:35:58PM +0100, Herve Codina wrote:
> A refcount issue can appeared in __fwnode_link_del() due to the
> pr_debug() call:
> WARNING: CPU: 0 PID: 901 at lib/refcount.c:25 refcount_warn_saturate+0xe5/0x110
> Call Trace:
> <TASK>
> ...
> of_node_get+0x1e/0x30
> of_fwnode_get+0x28/0x40
> fwnode_full_name_string+0x34/0x90
> fwnode_string+0xdb/0x140
> ...
> vsnprintf+0x17b/0x630
> ...
> __fwnode_link_del+0x25/0xa0
> fwnode_links_purge+0x39/0xb0
> of_node_release+0xd9/0x180
> ...
>
> Indeed, an fwnode (of_node) is being destroyed and so, of_node_release()
> is called because the of_node refcount reached 0.
> From of_node_release() several function calls are done and lead to
> a pr_debug() calls with %pfwf to print the fwnode full name.
> The issue is not present if we change %pfwf to %pfwP.
>
> To print the full name, %pfwf iterates over the current node and its
> parents and obtain/drop a reference to all nodes involved.
>
> In order to allow to print the full name (%pfwf) of a node while it is
> being destroyed, do not obtain/drop a reference to this current node.
One nit-pick below, otherwise
Reviewed-by: Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx>
...
> /* Loop starting from the root node to the current node. */
> for (depth = fwnode_count_parents(fwnode); depth >= 0; depth--) {
> - struct fwnode_handle *__fwnode =
> - fwnode_get_nth_parent(fwnode, depth);
> + /*
> + * Only get a reference for other nodes (ie parents node).
"parent's node" (doesn't look right)? Or "parent nodes"?
> + * fwnode refcount may be 0 here.
> + */
> + struct fwnode_handle *__fwnode = depth ?
> + fwnode_get_nth_parent(fwnode, depth) : fwnode;
>
> buf = string(buf, end, fwnode_get_name_prefix(__fwnode),
> default_str_spec);
> buf = string(buf, end, fwnode_get_name(__fwnode),
> default_str_spec);
>
> - fwnode_handle_put(__fwnode);
> + if (depth)
> + fwnode_handle_put(__fwnode);
> }
--
With Best Regards,
Andy Shevchenko
