From: Zeng Heng <zengheng4@huawei.com>
To: <linus.walleij@linaro.org>
Cc: <linux-kernel@vger.kernel.org>, <xiexiuqi@huawei.com>,
<linux-gpio@vger.kernel.org>, <weiyongjun1@huawei.com>,
<dan.carpenter@linaro.org>, <liwei391@huawei.com>
Subject: [PATCH] pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
Date: Mon, 15 Apr 2024 18:53:28 +0800 [thread overview]
Message-ID: <20240415105328.3651441-1-zengheng4@huawei.com> (raw)
If we fail to allocate propname buffer, we need to drop the reference
count we just took. Because the pinctrl_dt_free_maps() includes the
droping operation, here we call it directly.
Fixes: 91d5c5060ee2 ("pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map")
Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Zeng Heng <zengheng4@huawei.com>
---
drivers/pinctrl/devicetree.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c
index df1efc2e5202..6a94ecd6a8de 100644
--- a/drivers/pinctrl/devicetree.c
+++ b/drivers/pinctrl/devicetree.c
@@ -220,14 +220,16 @@ int pinctrl_dt_to_map(struct pinctrl *p, struct pinctrl_dev *pctldev)
for (state = 0; ; state++) {
/* Retrieve the pinctrl-* property */
propname = kasprintf(GFP_KERNEL, "pinctrl-%d", state);
- if (!propname)
- return -ENOMEM;
+ if (!propname) {
+ ret = -ENOMEM;
+ goto err;
+ }
prop = of_find_property(np, propname, &size);
kfree(propname);
if (!prop) {
if (state == 0) {
- of_node_put(np);
- return -ENODEV;
+ ret = -ENODEV;
+ goto err;
}
break;
}
--
2.25.1
next reply other threads:[~2024-04-15 10:54 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-15 10:53 Zeng Heng [this message]
2024-04-15 11:08 ` [PATCH] pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() Dan Carpenter
2024-04-15 16:36 ` Markus Elfring
2024-04-16 13:33 ` Linus Walleij
2024-04-17 15:30 ` Andy Shevchenko
2024-04-17 15:38 ` Dan Carpenter
2024-04-17 17:12 ` Andy Shevchenko
2024-04-17 17:49 ` Dan Carpenter
2024-04-18 10:05 ` Andy Shevchenko
2024-04-19 13:24 ` Linus Walleij
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240415105328.3651441-1-zengheng4@huawei.com \
--to=zengheng4@huawei.com \
--cc=dan.carpenter@linaro.org \
--cc=linus.walleij@linaro.org \
--cc=linux-gpio@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=liwei391@huawei.com \
--cc=weiyongjun1@huawei.com \
--cc=xiexiuqi@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).