diff options
| author | Miles Krause <mileskrause5200@gmail.com> | 2026-09-09 19:26:26 -0400 |
|---|---|---|
| committer | Krzysztof Kozlowski <krzk@kernel.org> | 2026-09-15 09:08:25 +0200 |
| commit | 314ef67d673284d4c070455bd62d332f6d0f8634 (patch) | |
| tree | 19b9eb174d29a06a44979da8dccb42a1630ef007 /drivers/memory | |
| parent | f4e16143420f4021431cc652ebd71e176267ecbc (diff) | |
memory: emif: fix device_node reference leak on np_ddr
of_get_memory_device_details() takes a reference on the DDR device
node via of_parse_phandle() and stores it in emif->np_ddr for later
use, but drops that reference without calling of_node_put() on two
error paths: the devm_kzalloc() allocation-failure check and the
is_dev_data_valid() check. Both return NULL immediately, leaking the
node reference each time either failure triggers.
The same reference is also never released on the success path: it is
kept for the life of the bound device (compared against a later
instance's np_ddr in the duplicate-DDR-geometry check) but
emif_remove() never calls of_node_put() on it, leaking it every time
an EMIF device unbinds. of_node_put() on a NULL pointer is a no-op, so
this is also safe for the non-DT get_device_details() path, where
np_ddr is left NULL by devm_kzalloc().
Fixes: e6b42eb6a66c ("memory: emif: add device tree support to emif driver")
Signed-off-by: Miles Krause <mileskrause5200@gmail.com>
Link: https://patch.msgid.link/20260909-master-v1-1-8800f5647ab2@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Diffstat (limited to 'drivers/memory')
| -rw-r--r-- | drivers/memory/emif.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/memory/emif.c b/drivers/memory/emif.c index 2fadad0666b1..44ccc2561835 100644 --- a/drivers/memory/emif.c +++ b/drivers/memory/emif.c @@ -922,6 +922,7 @@ static struct emif_data *of_get_memory_device_details( if (!emif || !pd || !dev_info) { dev_err(dev, "%s: Out of memory!!\n", __func__); + of_node_put(np_ddr); goto error; } @@ -946,6 +947,7 @@ static struct emif_data *of_get_memory_device_details( pd->device_info->io_width, pd->phy_type, pd->ip_rev, emif->dev)) { dev_err(dev, "%s: invalid device data!!\n", __func__); + of_node_put(np_ddr); goto error; } /* @@ -1140,6 +1142,7 @@ static void emif_remove(struct platform_device *pdev) struct emif_data *emif = platform_get_drvdata(pdev); emif_debugfs_exit(emif); + of_node_put(emif->np_ddr); } static void emif_shutdown(struct platform_device *pdev) |