Hello Dan,

On Fri, 28 Oct 2022 15:34:39 +0300 Dan Carpenter dan.carpenter@oracle.com wrote:

On Fri, Oct 28, 2022 at 10:19:26AM +0200, luca.ceresoli@bootlin.com wrote:

...

From: Luca Ceresoli luca.ceresoli@bootlin.com

At probe time this code path is followed:

• tegra_csi_init
  • tegra_csi_channels_alloc
    • for_each_child_of_node(node, channel) -- iterates over channels
      • automatically gets 'channel'
        • tegra_csi_channel_alloc()
          • saves into chan->of_node a pointer to the channel OF node
      • automatically gets and puts 'channel'
      • now the node saved in chan->of_node has refcount 0, can disappear
  • tegra_csi_channels_init
    • iterates over channels
      • tegra_csi_channel_init -- uses chan->of_node

After that, chan->of_node keeps storing the node until the device is removed.

of_node_get() the node and of_node_put() it during teardown to avoid any risk.

Fixes: 1ebaeb09830f ("media: tegra-video: Add support for external sensor capture") Cc: stable@vger.kernel.org Cc: Sowjanya Komatineni skomatineni@nvidia.com Signed-off-by: Luca Ceresoli luca.ceresoli@bootlin.com

---

drivers/staging/media/tegra-video/csi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/media/tegra-video/csi.c b/drivers/staging/media/tegra-video/csi.c index b26e44adb2be..1b05f620b476 100644 --- a/drivers/staging/media/tegra-video/csi.c +++ b/drivers/staging/media/tegra-video/csi.c @@ -433,7 +433,7 @@ static int tegra_csi_channel_alloc(struct tegra_csi *csi, for (i = 0; i < chan->numgangports; i++) chan->csi_port_nums[i] = port_num + i * CSI_PORTS_PER_BRICK;

• chan->of_node = node;

• chan->of_node = of_node_get(node); chan->numpads = num_pads; if (num_pads & 0x2) { chan->pads[0].flags = MEDIA_PAD_FL_SINK;

@@ -640,6 +640,7 @@ static void tegra_csi_channels_cleanup(struct tegra_csi *csi) media_entity_cleanup(&subdev->entity); }

• of_node_put(chan->of_node);
  

  list_del(&chan->list); kfree(chan);

Not related to your patch, but this kind of "one function cleans up everything" style is always buggy. For example, here it should be:

• if (chan->mipi)
  

• if (!IS_ERR_OR_NULL(chan->mipi))
  tegra_mipi_free(chan->mipi);
  

I sort of agree the code could be clearer here, but looking at the code in detail, this cannot happen. chan->mipi is set in one place only, and if it is an error the whole probe fails. So it can be either NULL or a valid pointer here.

Regarding my patch, do you think it is valid?

Best regards.

Hello Dan,

On Fri, 28 Oct 2022 20:06:34 +0300 Dan Carpenter dan.carpenter@oracle.com wrote:

On Fri, Oct 28, 2022 at 06:58:47PM +0200, Luca Ceresoli wrote:

...

Hello Dan,

On Fri, 28 Oct 2022 15:34:39 +0300 Dan Carpenter dan.carpenter@oracle.com wrote:

...

On Fri, Oct 28, 2022 at 10:19:26AM +0200, luca.ceresoli@bootlin.com wrote:

...

From: Luca Ceresoli luca.ceresoli@bootlin.com

At probe time this code path is followed:

• tegra_csi_init
  • tegra_csi_channels_alloc
    • for_each_child_of_node(node, channel) -- iterates over channels
      • automatically gets 'channel'
        • tegra_csi_channel_alloc()
          • saves into chan->of_node a pointer to the channel OF node
      • automatically gets and puts 'channel'
      • now the node saved in chan->of_node has refcount 0, can disappear
  • tegra_csi_channels_init
    • iterates over channels
      • tegra_csi_channel_init -- uses chan->of_node

After that, chan->of_node keeps storing the node until the device is removed.

of_node_get() the node and of_node_put() it during teardown to avoid any risk.

Fixes: 1ebaeb09830f ("media: tegra-video: Add support for external sensor capture") Cc: stable@vger.kernel.org Cc: Sowjanya Komatineni skomatineni@nvidia.com Signed-off-by: Luca Ceresoli luca.ceresoli@bootlin.com

---

drivers/staging/media/tegra-video/csi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/media/tegra-video/csi.c b/drivers/staging/media/tegra-video/csi.c index b26e44adb2be..1b05f620b476 100644 --- a/drivers/staging/media/tegra-video/csi.c +++ b/drivers/staging/media/tegra-video/csi.c @@ -433,7 +433,7 @@ static int tegra_csi_channel_alloc(struct tegra_csi *csi, for (i = 0; i < chan->numgangports; i++) chan->csi_port_nums[i] = port_num + i * CSI_PORTS_PER_BRICK;

• chan->of_node = node;

• chan->of_node = of_node_get(node); chan->numpads = num_pads; if (num_pads & 0x2) { chan->pads[0].flags = MEDIA_PAD_FL_SINK;

@@ -640,6 +640,7 @@ static void tegra_csi_channels_cleanup(struct tegra_csi *csi) media_entity_cleanup(&subdev->entity); }

• of_node_put(chan->of_node);
  

  list_del(&chan->list); kfree(chan);

Not related to your patch, but this kind of "one function cleans up everything" style is always buggy. For example, here it should be:

• if (chan->mipi)
  

• if (!IS_ERR_OR_NULL(chan->mipi))
  tegra_mipi_free(chan->mipi);  
  

I sort of agree the code could be clearer here, but looking at the code in detail, this cannot happen. chan->mipi is set in one place only, and if it is an error the whole probe fails. So it can be either NULL or a valid pointer here.

I assumed that tegra_csi_channels_cleanup() would clean up if tegra_csi_channel_alloc() fails. Otherwise then that's several different even worse bugs.

HINT: Let's all hope my initial analysis was correct.

Indeed you have a point. Apologies for having replied in a hurry and for the resulting noise.

I'm going to send a patch to fix the chan->mipi mess. However I think the best way to do so would be a oneliner:

@@ -491,6 +491,7 @@ static int tegra_csi_channel_alloc(struct tegra_csi *csi, chan->mipi = tegra_mipi_request(csi->dev, node); if (IS_ERR(chan->mipi)) { ret = PTR_ERR(chan->mipi); + chan->mipi = NULL; dev_err(csi->dev, "failed to get mipi device: %d\n", ret); }

This would be a correct implementation of the initial intent as it can be inferred from the code, i.e. chan->mipi being either NULL or a valid pointer. This makes sense as chan->mipi is assigned in a single place.