Hi Herve,

On Tue, Nov 14, 2023 at 03:35:58PM +0100, Herve Codina wrote:

A refcount issue can appeared in __fwnode_link_del() due to the pr_debug() call: WARNING: CPU: 0 PID: 901 at lib/refcount.c:25 refcount_warn_saturate+0xe5/0x110 Call Trace:

<TASK> ... of_node_get+0x1e/0x30 of_fwnode_get+0x28/0x40 fwnode_full_name_string+0x34/0x90 fwnode_string+0xdb/0x140 ... vsnprintf+0x17b/0x630 ... __fwnode_link_del+0x25/0xa0 fwnode_links_purge+0x39/0xb0 of_node_release+0xd9/0x180 ...

Indeed, an fwnode (of_node) is being destroyed and so, of_node_release() is called because the of_node refcount reached 0. From of_node_release() several function calls are done and lead to a pr_debug() calls with %pfwf to print the fwnode full name. The issue is not present if we change %pfwf to %pfwP.

To print the full name, %pfwf iterates over the current node and its parents and obtain/drop a reference to all nodes involved.

In order to allow to print the full name (%pfwf) of a node while it is being destroyed, do not obtain/drop a reference to this current node.

Fixes: a92eb7621b9f ("lib/vsprintf: Make use of fwnode API to obtain node names and separators") Cc: stable@vger.kernel.org Signed-off-by: Herve Codina herve.codina@bootlin.com

---

Changes v1 -> v2

• Avoid handling current node out of the loop. Instead obtain/drop references in the loop based on the depth value.
• Remove some of the backtrace lines in the commit log.

lib/vsprintf.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/lib/vsprintf.c b/lib/vsprintf.c index afb88b24fa74..633f5481ac17 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -2110,15 +2110,20 @@ char *fwnode_full_name_string(struct fwnode_handle *fwnode, char *buf, /* Loop starting from the root node to the current node. */ for (depth = fwnode_count_parents(fwnode); depth >= 0; depth--) {

• struct fwnode_handle *__fwnode =
  

• 	fwnode_get_nth_parent(fwnode, depth);
  

• /*
  

•  * Only get a reference for other nodes (ie parents node).
  

"i.e."

With that,

Reviewed-by: Sakari Ailus sakari.ailus@linux.intel.com

•  * fwnode refcount may be 0 here.
  

•  */
  

• struct fwnode_handle *__fwnode = depth ?
  

• 	fwnode_get_nth_parent(fwnode, depth) : fwnode;
  

buf = string(buf, end, fwnode_get_name_prefix(__fwnode), default_str_spec); buf = string(buf, end, fwnode_get_name(__fwnode), default_str_spec);

• fwnode_handle_put(__fwnode);
  

• if (depth)
  

• 	fwnode_handle_put(__fwnode);
  

  }

return buf;