linux-stable.git/drivers/of/base.c, branch linux-5.15.y

of: fix reference count leak in of_alias_scan()

2026-02-06T15:41:56+00:00

commit 81122fba08fa3ccafab6ed272a5c6f2203923a7e upstream.

of_find_node_by_path() returns a device_node with its refcount
incremented. When kstrtoint() fails or dt_alloc() fails, the function
continues to the next iteration without calling of_node_put(), causing
a reference count leak.

Add of_node_put(np) before continue on both error paths to properly
release the device_node reference.

Fixes: 611cad720148 ("dt: add of_alias_scan and of_alias_get_id")
Cc: stable@vger.kernel.org
Signed-off-by: Weigang He 
Link: https://patch.msgid.link/20260117091238.481243-1-geoffreyhe2@gmail.com
Signed-off-by: Rob Herring (Arm) 
Signed-off-by: Greg Kroah-Hartman

of: Fix of_find_node_opts_by_path() handling of alias+path+options

2025-03-13T11:50:26+00:00

commit b9e58c934c56aa35b0fb436d9afd86ef326bae0e upstream.

of_find_node_opts_by_path() fails to find OF device node when its
@path parameter have pattern below:

"alias-name/node-name-1/.../node-name-N:options".

The reason is that alias name length calculated by the API is wrong, as
explained by example below:

"testcase-alias/phandle-tests/consumer-a:testaliasoption".
 ^             ^                        ^
 0             14                       39

The right length of alias 'testcase-alias' is 14, but the result worked
out by the API is 39 which is obvious wrong.

Fix by using index of either '/' or ':' as the length who comes earlier.

Fixes: 75c28c09af99 ("of: add optional options parameter to of_find_node_by_path()")
Cc: stable@vger.kernel.org
Signed-off-by: Zijun Hu 
Link: https://lore.kernel.org/r/20241216-of_core_fix-v2-1-e69b8f60da63@quicinc.com
Signed-off-by: Rob Herring (Arm) 
Signed-off-by: Greg Kroah-Hartman

of: Correct child specifier used as input of the 2nd nexus node

2025-03-13T11:50:26+00:00

commit e4c00c9b1f70cd11792ff5b825899a6ee0234a62 upstream.

API of_parse_phandle_with_args_map() will use wrong input for nexus node
Nexus_2 as shown below:

    Node_1		Nexus_1                              Nexus_2
&Nexus_1,arg_1 -> arg_1,&Nexus_2,arg_2' -> &Nexus_2,arg_2 -> arg_2,...
		  map-pass-thru=<...>

Nexus_1's output arg_2 should be used as input of Nexus_2, but the API
wrongly uses arg_2' instead which != arg_2 due to Nexus_1's map-pass-thru.

Fix by always making @match_array point to @initial_match_array into
which to store nexus output.

Fixes: bd6f2fd5a1d5 ("of: Support parsing phandle argument lists through a nexus node")
Cc: stable@vger.kernel.org
Signed-off-by: Zijun Hu 
Link: https://lore.kernel.org/r/20250109-of_core_fix-v4-1-db8a72415b8c@quicinc.com
Signed-off-by: Rob Herring (Arm) 
Signed-off-by: Greg Kroah-Hartman

of: Fix error path in of_parse_phandle_with_args_map()

2025-01-09T12:28:36+00:00

commit d7dfa7fde63dde4d2ec0083133efe2c6686c03ff upstream.

The current code uses some 'goto put;' to cancel the parsing operation
and can lead to a return code value of 0 even on error cases.

Indeed, some goto calls are done from a loop without setting the ret
value explicitly before the goto call and so the ret value can be set to
0 due to operation done in previous loop iteration. For instance match
can be set to 0 in the previous loop iteration (leading to a new
iteration) but ret can also be set to 0 it the of_property_read_u32()
call succeed. In that case if no match are found or if an error is
detected the new iteration, the return value can be wrongly 0.

Avoid those cases setting the ret value explicitly before the goto
calls.

Fixes: bd6f2fd5a1d5 ("of: Support parsing phandle argument lists through a nexus node")
Cc: stable@vger.kernel.org
Signed-off-by: Herve Codina 
Link: https://lore.kernel.org/r/20241202165819.158681-1-herve.codina@bootlin.com
Signed-off-by: Rob Herring (Arm) 
Signed-off-by: Greg Kroah-Hartman

of: Fix double free in of_parse_phandle_with_args_map

2024-01-25T22:52:46+00:00

[ Upstream commit 4dde83569832f9377362e50f7748463340c5db6b ]

In of_parse_phandle_with_args_map() the inner loop that
iterates through the map entries calls of_node_put(new)
to free the reference acquired by the previous iteration
of the inner loop. This assumes that the value of "new" is
NULL on the first iteration of the inner loop.

Make sure that this is true in all iterations of the outer
loop by setting "new" to NULL after its value is assigned to "cur".

Extend the unittest to detect the double free and add an additional
test case that actually triggers this path.

Fixes: bd6f2fd5a1 ("of: Support parsing phandle argument lists through a nexus node")
Cc: Stephen Boyd 
Signed-off-by: "Christian A. Ehrhardt" 
Link: https://lore.kernel.org/r/20231229105411.1603434-1-lk@c--e.de
Signed-off-by: Rob Herring 
Signed-off-by: Sasha Levin

of: base: Improve argument length mismatch error

2022-01-27T10:05:19+00:00

commit 5d05b811b5acb92fc581a7b328b36646c86f5ab9 upstream.

The cells_name field of of_phandle_iterator might be NULL. Use the
phandle name instead. With this change instead of:

  OF: /soc/pinctrl@1000000: (null) = 3 found 2

We get:

  OF: /soc/pinctrl@1000000: phandle pinctrl@1000000 needs 3, found 2

Which is a more helpful messages making DT debugging easier.

In this particular example the phandle name looks like duplicate of the
same node name. But note that the first node is the parent node
(it->parent), while the second is the phandle target (it->node). They
happen to be the same in the case that triggered this improvement. See
commit 72cb4c48a46a ("arm64: dts: qcom: ipq6018: Fix gpio-ranges
property").

Signed-off-by: Baruch Siach 
Signed-off-by: Rob Herring 
Link: https://lore.kernel.org/r/f6a68e0088a552ea9dfd4d8e3b5b586d92594738.1640881913.git.baruch@tkos.co.il
Signed-off-by: Greg Kroah-Hartman

of: base: Fix phandle argument length mismatch error message

2022-01-27T10:04:20+00:00

[ Upstream commit 94a4950a4acff39b5847cc1fee4f65e160813493 ]

The cell_count field of of_phandle_iterator is the number of cells we
expect in the phandle arguments list when cells_name is missing. The
error message should show the number of cells we actually see.

Fixes: af3be70a3211 ("of: Improve of_phandle_iterator_next() error message")
Cc: Florian Fainelli 
Signed-off-by: Baruch Siach 
Signed-off-by: Rob Herring 
Link: https://lore.kernel.org/r/96519ac55be90a63fa44afe01480c30d08535465.1640881913.git.baruch@tkos.co.il
Signed-off-by: Sasha Levin

fbdev: simplefb: fix Kconfig dependencies

2021-10-06T09:12:28+00:00

Configurations with both CONFIG_FB_SIMPLE=y and CONFIG_DRM_SIMPLEDRM=m
are allowed by Kconfig because the 'depends on !DRM_SIMPLEDRM' dependency
does not disallow FB_SIMPLE as long as SIMPLEDRM is not built-in. This
can however result in a build failure when cfb_fillrect() etc are then
also in loadable modules:

x86_64-linux-ld: drivers/video/fbdev/simplefb.o:(.rodata+0x1f8): undefined reference to `cfb_fillrect'
x86_64-linux-ld: drivers/video/fbdev/simplefb.o:(.rodata+0x200): undefined reference to `cfb_copyarea'
x86_64-linux-ld: drivers/video/fbdev/simplefb.o:(.rodata+0x208): undefined reference to `cfb_imageblit'

To work around this, change FB_SIMPLE to be a 'tristate' symbol,
which still allows both to be =m together, but not one of them to
be =y if the other one is =m. If a distro kernel picks this
configuration, it can be determined by local policy which of
the two modules gets loaded. The 'of_chosen' export is needed
as this is the first loadable module referencing it.

Alternatively, the Kconfig dependency could be changed to
'depends on DRM_SIMPLEDRM=n', which would forbid the configuration
with both drivers.

Fixes: 11e8f5fd223b ("drm: Add simpledrm driver")
Acked-by: Rob Herring  # for drivers/of/
Link: https://lore.kernel.org/all/20210721151839.2484245-1-arnd@kernel.org/
Signed-off-by: Arnd Bergmann 
Cc: Thomas Zimmermann 
Cc: Daniel Vetter  # fbdev support
Cc: Maxime Ripard 
Cc: Liam Girdwood 
Cc: Mark Brown 
Cc: Daniel Vetter 
Cc: Borislav Petkov 
Cc: Javier Martinez Canillas 
Cc: Randy Dunlap 
Cc: Geert Uytterhoeven 
Cc: Peter Collingbourne 
Cc: Andy Shevchenko 
Cc: dri-devel@lists.freedesktop.org
Cc: linux-kernel@vger.kernel.org
Cc:  # v5.14+
Signed-off-by: Thomas Zimmermann 
Link: https://patchwork.freedesktop.org/patch/msgid/20210928145243.1098064-1-arnd@kernel.org
Signed-off-by: Maarten Lankhorst

Merge tag 'devicetree-for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux

2021-09-02T01:34:51+00:00

Pull devicetree updates from Rob Herring:

 - Refactor arch kdump DT related code to a common implementation

 - Add fw_devlink tracking for 'phy-handle', 'leds', 'backlight',
   'resets', and 'pwm' properties

 - Various clean-ups to DT FDT code

 - Fix a runtime error for !CONFIG_SYSFS

 - Convert Synopsys DW PCI and derivative binding docs to schemas. Add
   Toshiba Visconti PCIe binding.

 - Convert a bunch of memory controller bindings to schemas

 - Covert eeprom-93xx46, Samsung Exynos TRNG, Samsung Exynos IRQ
   combiner, arm-charlcd, img-ascii-lcd, UniPhier eFuse, Xilinx Zynq
   MPSoC FPGA, Xilinx Zynq MPSoC reset, Mediatek mmsys, Gemini boards,
   brcm,iproc-i2c, faraday,ftpci100, and ks8851 net to DT schema.

 - Extend nvmem bindings to handle bit offsets in unit-addresses

 - Add DT schemas for HiKey 970 PCIe PHY

 - Remove unused ZTE, energymicro,efm32-timer, and Exynos SATA bindings

 - Enable dtc pci_device_reg warning by default

 - Fixes for handling 'unevaluatedProperties' in preparation to enable
   pending support in the tooling for jsonschema 2020-12 draft

* tag 'devicetree-for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (78 commits)
  dt-bindings: display: remove zte,vou.txt binding doc
  dt-bindings: hwmon: merge max1619 into trivial devices
  dt-bindings: mtd-physmap: Add 'arm,vexpress-flash' compatible
  dt-bindings: PCI: imx6: convert the imx pcie controller to dtschema
  dt-bindings: Use 'enum' instead of 'oneOf' plus 'const' entries
  dt-bindings: Add vendor prefix for Topic Embedded Systems
  of: fdt: Rename reserve_elfcorehdr() to fdt_reserve_elfcorehdr()
  arm64: kdump: Remove custom linux,usable-memory-range handling
  arm64: kdump: Remove custom linux,elfcorehdr handling
  riscv: Remove non-standard linux,elfcorehdr handling
  of: fdt: Use IS_ENABLED(CONFIG_BLK_DEV_INITRD) instead of #ifdef
  of: fdt: Add generic support for handling usable memory range property
  of: fdt: Add generic support for handling elf core headers property
  crash_dump: Make elfcorehdr address/size symbols always visible
  dt-bindings: memory: convert Samsung Exynos DMC to dtschema
  dt-bindings: devfreq: event: convert Samsung Exynos PPMU to dtschema
  dt-bindings: devfreq: event: convert Samsung Exynos NoCP to dtschema
  kbuild: Enable dtc 'pci_device_reg' warning by default
  dt-bindings: soc: remove obsolete zte zx header
  dt-bindings: clock: remove obsolete zte zx header
  ...

of: base: remove unnecessary for loop

2021-07-15T13:35:49+00:00

In __of_get_next_child function, loop iteration for getting next node is
unnecessary.

for loop is already checking if next is NULL or not, and
of_node_get(next) always returns next itself.

Therefore checking return value in the if clause always evaluates to
true, and thus it always breaks out from for loop in the first iteration.

Remove the unnecessary for loop for readability.

I tested the code as below, and it showed that BUG was never called.

-       for (; next; next = next->sibling)
+       for (; next; next = next->sibling) {
                if (of_node_get(next))
                        break;
+               BUG();
+       }

Signed-off-by: Ohhoon Kwon 
Link: https://lore.kernel.org/r/20210701140328epcms1p85149318b6c18fa18b3c7c8e966c14db0@epcms1p8
Signed-off-by: Rob Herring