Commit b100b0b0 authored Jul 11, 2022 by Liang He Committed by Greg Kroah-Hartman Aug 25, 2022

gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data()



[ Upstream commit 5d07a692f9562f9c06e62cce369e9dd108173a0f ]

We should use of_node_get() when a new reference of device_node
is created. It is noted that the old reference stored in
'mm_gc->gc.of_node' should also be decreased.

This patch is based on the fact that there is a call site in function
'qe_add_gpiochips()' of src file 'drivers\soc\fsl\qe\gpio.c'. In this
function, of_mm_gpiochip_add_data() is contained in an iteration of
for_each_compatible_node() which will automatically increase and
decrease the refcount. So we need additional of_node_get() for the
reference escape in of_mm_gpiochip_add_data().

Fixes: a19e3da5 ("of/gpio: Kill of_gpio_chip and add members directly to gpio_chip")
Signed-off-by: Liang He <windhl@126.com>
Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 2f90813f

drivers/gpio/gpiolib-of.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -734,7 +734,8 @@ int of_mm_gpiochip_add_data(struct device_node *np,
		if (mm_gc->save_regs)
		mm_gc->save_regs(mm_gc);

		mm_gc->gc.of_node = np;
		of_node_put(mm_gc->gc.of_node);
		mm_gc->gc.of_node = of_node_get(np);

		ret = gpiochip_add_data(gc, data);
		if (ret)
		@@ -742,6 +743,7 @@ int of_mm_gpiochip_add_data(struct device_node *np,

		return 0;
		err2:
		of_node_put(np);
		iounmap(mm_gc->regs);
		err1:
		kfree(gc->label);