[PATCH 4/4] software node: skip dying children during traversal

[Peng Fan (OSS)]

From: Peng Fan <peng.fan@xxxxxxx>

A child swnode is removed from its parent's children list in
software_node_release(), which runs after its kobject refcount has
already reached zero. The fwnode child traversal helpers can therefore
find an entry that is in its release path and call kobject_get() on a
zero refcount.

Use kobject_get_unless_zero() in software_node_get_next_child() and
software_node_get_named_child_node() and keep scanning until a live
child is found or the list ends.

Signed-off-by: Peng Fan <peng.fan@xxxxxxx>
---
 drivers/base/swnode.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
index 4d95a59a27f0a..1354447069e10 100644
--- a/drivers/base/swnode.c
+++ b/drivers/base/swnode.c
@@ -515,7 +515,18 @@ software_node_get_next_child(const struct fwnode_handle *fwnode,
 		c = list_first_entry(&p->children, struct swnode, entry);
 
 	fwnode_handle_put(child);
-	return fwnode_handle_get(&c->fwnode);
+
+	for (;;) {
+		if (kobject_get_unless_zero(&c->kobj))
+			return &c->fwnode;
+
+		if (list_is_last(&c->entry, &p->children))
+			break;
+
+		c = list_next_entry(c, entry);
+	}
+
+	return NULL;
 }
 
 static struct fwnode_handle *
@@ -529,10 +540,9 @@ software_node_get_named_child_node(const struct fwnode_handle *fwnode,
 		return NULL;
 
 	list_for_each_entry(child, &swnode->children, entry) {
-		if (!strcmp(childname, kobject_name(&child->kobj))) {
-			swnode_get(child);
+		if (!strcmp(childname, kobject_name(&child->kobj)) &&
+		    kobject_get_unless_zero(&child->kobj))
 			return &child->fwnode;
-		}
 	}
 	return NULL;
 }

-- 
2.34.1