Skip to content
Commit 3a8cd545 authored by Ruiqiang Hao's avatar Ruiqiang Hao
Browse files

of: unittest: fix refcount error "use-after-free"

Commit a92eb762

 ("lib/vsprintf: Make use of fwnode API to obtain node
names and separators") replace function device_node_gen_full_name() with
function fwnode_full_name_string(), after this, outputing device node
information with "%pOF" in function of_node_release() will cause calltrace
below, so replace it with "%s".

	refcount_t: addition on 0; use-after-free.
	WARNING: CPU: 4 PID: 1486 at lib/refcount.c:25
	refcount_warn_saturate+0xa0/0x144
	Modules linked in:
	CPU: 4 PID: 1486 Comm: kworker/4:0 Not tainted
	5.7.0-rc7-yoctodev-standard #1
	Hardware name: Marvell OcteonTX CN96XX board (DT)
	Workqueue: events kobject_delayed_cleanup
	pstate: 00c00089 (nzcv daIf +PAN +UAO)
	pc : refcount_warn_saturate+0xa0/0x144
	lr : refcount_warn_saturate+0xa0/0x144
	sp : ffff80002486f7d0
	x29: ffff80002486f7d0 x28: ffff80001127ed80
	x27: ffff000b8bb7e600 x26: ffff800011e4cc48
	x25: ffff800010f7f6a0 x24: ffff000b8bb7e618
	x23: 0000000000000004 x22: 0000000000000004
	x21: ffff800011e4c8a1 x20: ffffffffffffffff
	x19: ffff000b8bb7e658 x18: 0000572bfca204a0
	x17: 0000000000000008 x16: 00009a33e1d77729
	x15: 0272600170c6d4f7 x14: ffff800010ee1a00
	x13: 0000000000000293 x12: 00000000d744fcc9
	x11: 0000000000000000 x10: 0000000000080000
	x9 : ffff80001012f388 x8 : 612d657375203b30
	x7 : 206e6f206e6f6974 x6 : ffff000bfca43eb2
	x5 : 00000000ffffffc8 x4 : 0000000000000000
	x3 : 0000000000000027 x2 : 0000000000000052
	x1 : b11c76d4687b7300 x0 : 0000000000000000
	Call trace:
	 refcount_warn_saturate+0xa0/0x144
	 kobject_get+0xb0/0xb4
	 of_node_get+0x28/0x40
	 of_fwnode_get+0x3c/0x60
	 fwnode_get_nth_parent+0x40/0x134
	 fwnode_full_name_string+0x4c/0xc4
	 device_node_string+0x41c/0x52c
	 pointer+0x28c/0x374
	 vsnprintf+0x1f0/0x730
	 vscnprintf+0x30/0x6c
	 vprintk_store+0x6c/0x220
	 vprintk_emit+0xd8/0x204
	 vprintk_default+0x50/0x8c
	 vprintk_func+0xfc/0x264
	 printk+0x68/0x8c
	 of_node_release+0x10c/0x12c
	 kobject_cleanup+0x6c/0x1a4
	 kobject_delayed_cleanup+0x14/0x20
	 process_one_work+0x298/0x6b0
	 worker_thread+0x78/0x3b0
	 kthread+0x144/0x150
	 ret_from_fork+0x10/0x18

Signed-off-by: default avatarRuiqiang Hao <Ruiqiang.Hao@windriver.com>
parent 869cc4f0
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment