[PATCH 05/10] regulator: core: Hold supply device reference until constraints are resolved in regulator_resolve_supply()

[Lee Jones]

In regulator_resolve_supply(), set_supply() previously consumed the
caller's lookup reference on &r->dev without taking its own reference
for rdev->supply, while the concurrent path (when rdev->supply was
already set) dropped put_device(&r->dev) immediately after unlocking
and before retrying set_machine_constraints().  In both paths, if
set_machine_constraints() fails (which may drop rdev->supply inside
set_machine_constraints() or race with a concurrent task in
unset_supply), the error path subsequently passes r to
regulator_lock_two(rdev, r, &ww_ctx) without holding a guaranteed local
reference on &r->dev.

Take a dedicated device reference for rdev->supply in set_supply() to
match _regulator_put(), and retain the local lookup reference on &r->dev
throughout regulator_resolve_supply() until returning.

Fixes: 8d38423d9dea ("regulator: core: don't fail regulator_register() with missing required supply")
Closes: https://sashiko.dev/#/bug/linux-3a22ff58-1a66-4a6a-9e19-83135ef603e0
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Lee Jones <lee@xxxxxxxxxx>
---
 drivers/regulator/core.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 935fee27f126..6d522731e4d9 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1842,6 +1842,7 @@ static int set_supply(struct regulator_dev *rdev,
 		err = -ENOMEM;
 		return err;
 	}
+	get_device(&supply_rdev->dev);
 	supply_rdev->open_count++;
 
 	return 0;
@@ -2290,22 +2291,20 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
 		supply = rdev->supply;
 
 		regulator_unlock_two(rdev, r, &ww_ctx);
-		put_device(&r->dev);
 
 		/*
 		 * Supply resolved by concurrent task, and constraints set as
 		 * well (or not required): fast path.
 		 */
 		if (done)
-			goto out;
+			goto out_put;
 
 		do_final_setup = false;
 	} else {
 		ret = set_supply(rdev, r);
 		if (ret < 0) {
 			regulator_unlock_two(rdev, r, &ww_ctx);
-			put_device(&r->dev);
-			goto out;
+			goto out_put;
 		}
 
 		supply = rdev->supply;
@@ -2342,7 +2341,7 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
 			 */
 			regulator_unlock_dependent(rdev, &ww_ctx);
 			ret = -EPROBE_DEFER;
-			goto out;
+			goto out_put;
 		}
 
 		ret = set_machine_constraints(rdev, true);
@@ -2364,7 +2363,7 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
 				 * that again via unset_supply.
 				 */
 				regulator_unlock_two(rdev, r, &ww_ctx);
-				goto out;
+				goto out_put;
 			}
 
 			unregister_regulator_event_forwarding(rdev);
@@ -2376,11 +2375,13 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
 	regulator_unlock_dependent(rdev, &ww_ctx);
 
 	if (!do_final_setup)
-		goto out;
+		goto out_put;
 
 	/* rdev->supply was created in set_supply() */
 	link_and_create_debugfs(rdev->supply, rdev->supply->rdev, &rdev->dev);
 
+out_put:
+	put_device(&r->dev);
 out:
 	return ret;
 
@@ -2391,6 +2392,7 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
 	regulator_unlock_two(rdev, supply->rdev, &ww_ctx);
 
 	regulator_put(supply);
+	put_device(&r->dev);
 
 	return ret;
 }
-- 
2.56.0.385.gac671c819a-goog