Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint()

The fsl_mc_get_endpoint() function may call fsl_mc_device_lookup()
twice, which would increment the device's reference count twice if
both lookups find a device. This could lead to a reference count leak.

Found by code review.

Cc: stable@vger.kernel.org
Fixes: 1ac210d128ef ("bus: fsl-mc: add the fsl_mc_get_endpoint function")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Fixes: 8567494cebe5 ("bus: fsl-mc: rescan devices if endpoint not found")
Link: https://patch.msgid.link/20250717022309.3339976-1-make24@iscas.ac.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Ma Ke and committed by
Jakub Kicinski
bddbe13d 6832a931

+9 -10
+9 -10
drivers/bus/fsl-mc/fsl-mc-bus.c
··· 943 943 struct fsl_mc_obj_desc endpoint_desc = {{ 0 }}; 944 944 struct dprc_endpoint endpoint1 = {{ 0 }}; 945 945 struct dprc_endpoint endpoint2 = {{ 0 }}; 946 + struct fsl_mc_bus *mc_bus; 946 947 int state, err; 947 948 948 949 mc_bus_dev = to_fsl_mc_device(mc_dev->dev.parent); ··· 967 966 strcpy(endpoint_desc.type, endpoint2.type); 968 967 endpoint_desc.id = endpoint2.id; 969 968 endpoint = fsl_mc_device_lookup(&endpoint_desc, mc_bus_dev); 969 + if (endpoint) 970 + return endpoint; 970 971 971 972 /* 972 973 * We know that the device has an endpoint because we verified by ··· 976 973 * yet discovered by the fsl-mc bus, thus the lookup returned NULL. 977 974 * Force a rescan of the devices in this container and retry the lookup. 978 975 */ 979 - if (!endpoint) { 980 - struct fsl_mc_bus *mc_bus = to_fsl_mc_bus(mc_bus_dev); 981 - 982 - if (mutex_trylock(&mc_bus->scan_mutex)) { 983 - err = dprc_scan_objects(mc_bus_dev, true); 984 - mutex_unlock(&mc_bus->scan_mutex); 985 - } 986 - 987 - if (err < 0) 988 - return ERR_PTR(err); 976 + mc_bus = to_fsl_mc_bus(mc_bus_dev); 977 + if (mutex_trylock(&mc_bus->scan_mutex)) { 978 + err = dprc_scan_objects(mc_bus_dev, true); 979 + mutex_unlock(&mc_bus->scan_mutex); 989 980 } 981 + if (err < 0) 982 + return ERR_PTR(err); 990 983 991 984 endpoint = fsl_mc_device_lookup(&endpoint_desc, mc_bus_dev); 992 985 /*