linux-stable.git/drivers/of/base.c, branch v4.7.2

of: fix memory leak related to safe_name()

2016-08-20T16:11:02+00:00

commit d9fc880723321dbf16b2981e3f3e916b73942210 upstream.

Fix a memory leak resulting from memory allocation in safe_name().
This patch fixes all call sites of safe_name().

Mathieu Malaterre reported the memory leak on boot:

On my PowerMac device-tree would generate a duplicate name:

[    0.023043] device-tree: Duplicate name in PowerPC,G4@0, renamed to "l2-cache#1"

in this case a newly allocated name is generated by `safe_name`. However
in this case it is never deallocated.

The bug was found using kmemleak reported as:

unreferenced object 0xdf532e60 (size 32):
  comm "swapper", pid 1, jiffies 4294892300 (age 1993.532s)
  hex dump (first 32 bytes):
    6c 32 2d 63 61 63 68 65 23 31 00 dd e4 dd 1e c2  l2-cache#1......
    ec d4 ba ce 04 ec cc de 8e 85 e9 ca c4 ec cc 9e  ................
  backtrace:
    [] kvasprintf+0x64/0xc8
    [] kasprintf+0x4c/0x5c
    [] safe_name.isra.1+0x80/0xc4
    [] __of_attach_node_sysfs+0x6c/0x11c
    [] of_core_init+0x8c/0xf8
    [] kernel_init_freeable+0xd4/0x208
    [] kernel_init+0x24/0x11c
    [] ret_from_kernel_thread+0x5c/0x64

Link: https://bugzilla.kernel.org/show_bug.cgi?id=120331

Signed-off-by: Frank Rowand 
Reported-by: mathieu.malaterre@gmail.com
Tested-by: Mathieu Malaterre 
Signed-off-by: Rob Herring 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'devicetree-for-4.7' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux

2016-05-20T21:51:34+00:00

Pull devicetree updates from Rob Herring:

- Rewrite of the unflattening code to avoid recursion and lessen the
stack usage.

- Rewrite of the phandle args parsing code to get rid of the fixed args
size. This is needed for IOMMU code.

- Sync to latest dtc which adds more dts style checking. These
warnings are enabled with "W=1" compiles.

- Tegra documentation updates related to the above warnings.

- A bunch of spelling and other doc fixes.

- Various vendor prefix additions.

* tag 'devicetree-for-4.7' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (52 commits)
devicetree: Add Creative Technology vendor id
gpio: dt-bindings: add ibm,ppc4xx-gpio binding
of/unittest: Remove unnecessary module.h header inclusion
drivers/of: Fix build warning in populate_node()
drivers/of: Fix depth when unflattening devicetree
of: dynamic: changeset prop-update revert fix
drivers/of: Export of_detach_node()
drivers/of: Return allocated memory from of_fdt_unflatten_tree()
drivers/of: Specify parent node in of_fdt_unflatten_tree()
drivers/of: Rename unflatten_dt_node()
drivers/of: Avoid recursively calling unflatten_dt_node()
drivers/of: Split unflatten_dt_node()
of: include errno.h in of_graph.h
of: document refcount incrementation of of_get_cpu_node()
Documentation: dt: soc: fix spelling mistakes
Documentation: dt: power: fix spelling mistake
Documentation: dt: pinctrl: fix spelling mistake
Documentation: dt: opp: fix spelling mistake
Documentation: dt: net: fix spelling mistakes
Documentation: dt: mtd: fix spelling mistake
...

drivers/of: Add check for null property in of_remove_property()

2016-05-11T11:54:03+00:00

The validity of the property input argument to of_remove_property() is
never checked within the function and thus it is possible to pass a null
value. It happens that this will be picked up in __of_remove_property()
as no matching property of the device node will be found and thus an
error will be returned, however once again there is no explicit check
for a null value. By the time this is detected 2 locks have already been
acquired which is completely unnecessary if the property to remove is
null.

Add an explicit check in the function of_remove_property() for a null
property value and return -ENODEV in this case, this is consistent with
what the previous return value would have been when the null value was
not detected and passed to __of_remove_property().

By moving an explicit check for the property paramenter into the
of_remove_property() function, this will remove the need to perform this
check in calling code before invocation of the of_remove_property()
function.

Signed-off-by: Suraj Jitindar Singh 
Acked-by: Rob Herring 
Signed-off-by: Michael Ellerman

of: document refcount incrementation of of_get_cpu_node()

2016-04-25T15:06:39+00:00

This function increments refcount.  This is worth noting.

Signed-off-by: Masahiro Yamada 
Reviewed-by: Frank Rowand 
Signed-off-by: Rob Herring

of: Introduce of_phandle_iterator_args()

2016-04-19T22:25:15+00:00

This helper function can be used to copy the arguments of a
phandle to an array.

Signed-off-by: Joerg Roedel 
Signed-off-by: Rob Herring

of: Introduce of_for_each_phandle() helper macro

2016-04-19T22:25:14+00:00

With this macro any user can easily iterate over a list of
phandles. The patch also converts __of_parse_phandle_with_args()
to make use of the macro.

The of_count_phandle_with_args() function is not converted,
because the macro hides the return value of of_phandle_iterator_init(),
which is needed in there.

Signed-off-by: Joerg Roedel 
Signed-off-by: Rob Herring

of: Remove counting special case from __of_parse_phandle_with_args()

2016-04-19T22:25:14+00:00

The index = -1 case in __of_parse_phandle_with_args() is
used to just return the number of phandles. That special
case needs extra handling, so move it to the place where it
is needed: of_count_phandle_with_args().

This allows to further simplify __of_parse_phandle_with_args()
later on.

Signed-off-by: Joerg Roedel 
Signed-off-by: Rob Herring

of: Move phandle walking to of_phandle_iterator_next()

2016-04-19T22:25:13+00:00

Move the code to walk over the phandles out of the loop in
__of_parse_phandle_with_args() to a separate function that
just works with the iterator handle: of_phandle_iterator_next().

Signed-off-by: Joerg Roedel 
Signed-off-by: Rob Herring

of: Introduce struct of_phandle_iterator