github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-30 10:04:04 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions()

Browse Source 
of_get_child_by_name() returns a node pointer with refcount incremented,
which must be released with of_node_put() when done. However, in
parse_fixed_partitions(), when dedicated is true (i.e., a "partitions"
subnode was found), the ofpart_node obtained from of_get_child_by_name()
is never released on any code path.

Add of_node_put(ofpart_node) calls on all exit paths when dedicated is
true to fix the reference count leak.

This bug was detected by our static analysis tool.

Fixes: 562b4e91d3 ("mtd: parsers: ofpart: fix parsing subpartitions")
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
This commit is contained in:
Weigang He 2026-01-23 05:26:08 +00:00 committed by Miquel Raynal
parent 68cd8ef484
commit 7cce81df7d
1 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
drivers/mtd/parsers/ofpart_core.c
View File

@ -81,6 +81,7 @@ static int parse_fixed_partitions(struct mtd_info *master,
of_id = of_match_node(parse_ofpart_match_table, ofpart_node); of_id = of_match_node(parse_ofpart_match_table, ofpart_node);
if (dedicated && !of_id) { if (dedicated && !of_id) {
/* The 'partitions' subnode might be used by another parser */ /* The 'partitions' subnode might be used by another parser */
of_node_put(ofpart_node);
return 0; return 0;
} }
@ -95,12 +96,18 @@ static int parse_fixed_partitions(struct mtd_info *master,
nr_parts++; nr_parts++;
} }
if (nr_parts == 0) if (nr_parts == 0) {
if (dedicated)
of_node_put(ofpart_node);
return 0; return 0;
}
parts = kcalloc(nr_parts, sizeof(*parts), GFP_KERNEL); parts = kcalloc(nr_parts, sizeof(*parts), GFP_KERNEL);
if (!parts) if (!parts) {
if (dedicated)
of_node_put(ofpart_node);
return -ENOMEM; return -ENOMEM;
}
i = 0; i = 0;
for_each_child_of_node(ofpart_node, pp) { for_each_child_of_node(ofpart_node, pp) {
@ -179,6 +186,9 @@ static int parse_fixed_partitions(struct mtd_info *master,
if (quirks && quirks->post_parse) if (quirks && quirks->post_parse)
quirks->post_parse(master, parts, nr_parts); quirks->post_parse(master, parts, nr_parts);
if (dedicated)
of_node_put(ofpart_node);
*pparts = parts; *pparts = parts;
return nr_parts; return nr_parts;
@ -187,6 +197,8 @@ static int parse_fixed_partitions(struct mtd_info *master,
master->name, pp, mtd_node); master->name, pp, mtd_node);
ret = -EINVAL; ret = -EINVAL;
ofpart_none: ofpart_none:
if (dedicated)
of_node_put(ofpart_node);
of_node_put(pp); of_node_put(pp);
kfree(parts); kfree(parts);
return ret; return ret;