Re: [PATCH 2/2] PCI: rcar: Resolve of_find_matching_node() reference leak

From: Bjorn Helgaas
Date: Wed Jun 22 2022 - 07:05:48 EST


On Wed, Jun 22, 2022 at 09:45:49AM +0200, Geert Uytterhoeven wrote:
> Hi Bjorn,
>
> On Wed, Jun 22, 2022 at 4:57 AM Bjorn Helgaas <helgaas@xxxxxxxxxx> wrote:
> > From: Bjorn Helgaas <bhelgaas@xxxxxxxxxx>
> >
> > Previously, rcar_pcie_init() used of_find_matching_node() to search the
> > entire device tree for compatible strings for which we need to install an
> > abort handler. If we found one, we got a device_node with refcount
> > incremented, but we discarded the pointer and never released that
> > reference.
> >
> > Extend the struct rcar_variant to indicate whether each variant requires an
> > abort handler. Install the handler in rcar_pcie_probe() when needed.
> >
> > Signed-off-by: Bjorn Helgaas <bhelgaas@xxxxxxxxxx>
> > Cc: Liang He <windhl@xxxxxxx>
> > Cc: Geert Uytterhoeven <geert@xxxxxxxxxxxxxx>
>
> Thanks for your patch!
>
> > --- a/drivers/pci/controller/pcie-rcar-host.c
> > +++ b/drivers/pci/controller/pcie-rcar-host.c
>
> > @@ -964,12 +965,35 @@ static int rcar_pcie_parse_map_dma_ranges(struct rcar_pcie_host *host)
> > return err;
> > }
> >
> > +#ifdef CONFIG_ARM
> > +static int rcar_pcie_aarch32_abort_handler(unsigned long addr,
> > + unsigned int fsr, struct pt_regs *regs)
> > +{
> > + return !fixup_exception(regs);
> > +}
> > +#endif
> > +
> > +static void rcar_pcie_hook_aborts(void)
> > +{
> > +#ifdef CONFIG_ARM
> > +#ifdef CONFIG_ARM_LPAE
> > + hook_fault_code(17, rcar_pcie_aarch32_abort_handler, SIGBUS, 0,
> > + "asynchronous external abort");
> > +#else
> > + hook_fault_code(22, rcar_pcie_aarch32_abort_handler, SIGBUS, 0,
> > + "imprecise external abort");
> > +#endif
> > +#endif
> > +}
> > +
> > static const struct rcar_variant rcar_h1_data = {
> > .phy_init_fn = rcar_pcie_phy_init_h1,
> > + .hook_aborts = true,
> > };
> >
> > static const struct rcar_variant rcar_gen2_data = {
> > .phy_init_fn = rcar_pcie_phy_init_gen2,
> > + .hook_aborts = true,
> > };
> >
> > static const struct rcar_variant rcar_gen3_data = {
> > @@ -1035,6 +1059,9 @@ static int rcar_pcie_probe(struct platform_device *pdev)
> > goto err_clk_disable;
> > }
> >
> > + if (host->variant->hook_aborts)
> > + rcar_pcie_hook_aborts();
>
> I was quite sure there was a good reason why this was not done in
> .probe() before...
>
> And indeed, the original submission[1] did have a comment explaining
> that:
>
> + /*
> + * Since probe() can be deferred we need to make sure that
> + * hook_fault_code is not called after __init memory is freed
> + * by kernel and since rcar_pcie_abort_handler() is a no-op,
> + * we can install the handler here without risking it
> + * accessing some uninitialized driver state.
> + */
>
> No idea why it was removed in v2 and later, but the point is:
> hook_fault_code() is __init, so you cannot call it from a deferred
> probe.
> And you should have got a section mismatch warning ;-)

Oooh, thanks for that! I missed the builtin_platform_driver_probe()
vs builtin_platform_driver() difference that explains why doing this
at probe-time works for pci-ixp4xx.c but not here.

Bjorn