Unverified Commit 37c2c83c authored by Xin Xiong's avatar Xin Xiong Committed by Mark Brown
Browse files

spi: uniphier: fix reference count leak in uniphier_spi_probe() 



The issue happens in several error paths in uniphier_spi_probe().
When either dma_get_slave_caps() or devm_spi_register_master() returns
an error code, the function forgets to decrease the refcount of both
`dma_rx` and `dma_tx` objects, which may lead to refcount leaks.

Fix it by decrementing the reference count of specific objects in
those error paths.

Signed-off-by: default avatarXin Xiong <xiongx18@fudan.edu.cn>
Signed-off-by: default avatarXiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: default avatarXin Tan <tanxin.ctf@gmail.com>
Reviewed-by: default avatarKunihiko Hayashi <hayashi.kunihiko@socionext.com>
Fixes: 28d1dddc ("spi: uniphier: Add DMA transfer mode support")
Link: https://lore.kernel.org/r/20220125101214.35677-1-xiongx18@fudan.edu.cn


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent e937440f

drivers/spi/spi-uniphier.c

+14 −4
Original line number Diff line number Diff line
@@ -726,7 +726,7 @@ static int uniphier_spi_probe(struct platform_device *pdev) 
		if (ret) {

			dev_err(&pdev->dev, "failed to get TX DMA capacities: %d\n",

				ret);

			goto out_disable_clk;

			goto out_release_dma;

		}

		dma_tx_burst = caps.max_burst;

	}
@@ -735,7 +735,7 @@ static int uniphier_spi_probe(struct platform_device *pdev) 
	if (IS_ERR_OR_NULL(master->dma_rx)) {

		if (PTR_ERR(master->dma_rx) == -EPROBE_DEFER) {

			ret = -EPROBE_DEFER;

			goto out_disable_clk;

			goto out_release_dma;

		}

		master->dma_rx = NULL;

		dma_rx_burst = INT_MAX;
@@ -744,7 +744,7 @@ static int uniphier_spi_probe(struct platform_device *pdev) 
		if (ret) {

			dev_err(&pdev->dev, "failed to get RX DMA capacities: %d\n",

				ret);

			goto out_disable_clk;

			goto out_release_dma;

		}

		dma_rx_burst = caps.max_burst;

	}
@@ -753,10 +753,20 @@ static int uniphier_spi_probe(struct platform_device *pdev) 


	ret = devm_spi_register_master(&pdev->dev, master);

	if (ret)

		goto out_disable_clk;

		goto out_release_dma;



	return 0;



out_release_dma:

	if (!IS_ERR_OR_NULL(master->dma_rx)) {

		dma_release_channel(master->dma_rx);

		master->dma_rx = NULL;

	}

	if (!IS_ERR_OR_NULL(master->dma_tx)) {

		dma_release_channel(master->dma_tx);

		master->dma_tx = NULL;

	}



out_disable_clk:

	clk_disable_unprepare(priv->clk);