xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

net: dsa: bcm_sf2: Fix possible memory leak in bcm_sf2_mdio_register()

Browse Source 
commit 61b40cefe51af005c72dbdcf975a3d166c6e6406 upstream.

In bcm_sf2_mdio_register(), the class_find_device() will call get_device()
to increment reference count for priv->master_mii_bus->dev if
of_mdio_find_bus() succeeds. If mdiobus_alloc() or mdiobus_register()
fails, it will call get_device() twice without decrement reference count
for the device. And it is the same if bcm_sf2_mdio_register() succeeds but
fails in bcm_sf2_sw_probe(), or if bcm_sf2_sw_probe() succeeds. If the
reference count has not decremented to zero, the dev related resource will
not be freed.

So remove the get_device() in bcm_sf2_mdio_register(), and call
put_device() if mdiobus_alloc() or mdiobus_register() fails and in
bcm_sf2_mdio_unregister() to solve the issue.

And as Simon suggested, unwind from errors for bcm_sf2_mdio_register() and
just return 0 if it succeeds to make it cleaner.

Fixes: 461cd1b03e ("net: dsa: bcm_sf2: Register our slave MDIO bus")
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Suggested-by: Simon Horman <horms@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://lore.kernel.org/r/20231011032419.2423290-1-ruanjinjie@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Jinjie Ruan
2023-10-11 11:24:19 +08:00
committed by Greg Kroah-Hartman
parent a53fc06416
commit 923e47c0b4
1 changed files with 15 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
drivers/net/dsa/bcm_sf2.c
View File

@@ -497,17 +497,16 @@ static int bcm_sf2_mdio_register(struct dsa_switch *ds)
dn = of_find_compatible_node(NULL, NULL, "brcm,unimac-mdio"); dn = of_find_compatible_node(NULL, NULL, "brcm,unimac-mdio");
priv->master_mii_bus = of_mdio_find_bus(dn); priv->master_mii_bus = of_mdio_find_bus(dn);
if (!priv->master_mii_bus) { if (!priv->master_mii_bus) {
of_node_put(dn); err = -EPROBE_DEFER;
return -EPROBE_DEFER; goto err_of_node_put;
} }
get_device(&priv->master_mii_bus->dev);
priv->master_mii_dn = dn; priv->master_mii_dn = dn;
priv->slave_mii_bus = mdiobus_alloc(); priv->slave_mii_bus = mdiobus_alloc();
if (!priv->slave_mii_bus) { if (!priv->slave_mii_bus) {
of_node_put(dn); err = -ENOMEM;
return -ENOMEM; goto err_put_master_mii_bus_dev;
} }
priv->slave_mii_bus->priv = priv; priv->slave_mii_bus->priv = priv;
@@ -564,11 +563,17 @@ static int bcm_sf2_mdio_register(struct dsa_switch *ds)
} }
err = mdiobus_register(priv->slave_mii_bus); err = mdiobus_register(priv->slave_mii_bus);
if (err && dn) { if (err && dn)
mdiobus_free(priv->slave_mii_bus); goto err_free_slave_mii_bus;
of_node_put(dn);
}
return 0;
err_free_slave_mii_bus:
mdiobus_free(priv->slave_mii_bus);
err_put_master_mii_bus_dev:
put_device(&priv->master_mii_bus->dev);
err_of_node_put:
of_node_put(dn);
return err; return err;
} }
@@ -576,6 +581,7 @@ static void bcm_sf2_mdio_unregister(struct bcm_sf2_priv *priv)
{ {
mdiobus_unregister(priv->slave_mii_bus); mdiobus_unregister(priv->slave_mii_bus);
mdiobus_free(priv->slave_mii_bus); mdiobus_free(priv->slave_mii_bus);
put_device(&priv->master_mii_bus->dev);
of_node_put(priv->master_mii_dn); of_node_put(priv->master_mii_dn);
} }