On Sat, Oct 18, 2025 at 06:54:39AM +0000, Yong Wu (吴勇) wrote:
On Tue, 2025-10-07 at 11:43 +0200, Johan Hovold wrote:
Make sure to drop the references taken to the larb devices during probe on probe failure (e.g. probe deferral) and on driver unbind.
Note that commit 26593928564c ("iommu/mediatek: Add error path for loop of mm_dts_parse") fixed the leaks in a couple of error paths, but the references are still leaking on success and late failures.
@@ -1216,13 +1216,17 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m platform_device_put(plarbdev); }
if (!frst_avail_smicomm_node)return -EINVAL;
if (!frst_avail_smicomm_node) {ret = -EINVAL;goto err_larbdev_put;There already is a "platform_device_put(plarbdev);" at the end of "for" loop, then no need put_device for it outside the "for" loop or outside this function?
You're right, thanks for catching that.
But this means that we have an existing potential use-after-free as if, for example, the driver probe defers we would put the reference to any previously looked up larbs twice.
I've just sent a v3 which fixes this by dropping the platform_device_put() after successful lookup as it is expected that the driver keeps the references while it uses the larb devices:
https://lore.kernel.org/lkml/20251020045318.30690-1-johan@kernel.org/
Johan