[PATCH] nvmem: core: balance the layout module ref in nvmem_cell_get_from_lookup()

[PATCH] nvmem: core: balance the layout module ref in nvmem_cell_get_from_lookup()

[Yu Zhang]

nvmem_cell_put() unconditionally calls nvmem_layout_module_put(), which
does module_put() on the layout driver module when nvmem->layout is set.
of_nvmem_cell_get() balances that with nvmem_layout_module_get_optional(),
but nvmem_cell_get_from_lookup() - the non-DT lookup-table path - does
not take the reference.

A consumer that resolves a cell of a layout-backed nvmem device through a
cell lookup table therefore drops a layout-module reference it never
took. That underflows the layout driver's module refcount and can let the
module be unloaded while still referenced.

Take the layout module reference on the lookup path as well, releasing it
on the error paths, mirroring of_nvmem_cell_get().

Signed-off-by: Yu Zhang <yuz08559@gmail.com>
---
 drivers/nvmem/core.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 7d4cce8..34ec7d6 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -1324,6 +1324,9 @@ static struct nvmem_cell *nvmem_create_cell(struct nvmem_cell_entry *entry,
 	return cell;
 }
 
+static int nvmem_layout_module_get_optional(struct nvmem_device *nvmem);
+static void nvmem_layout_module_put(struct nvmem_device *nvmem);
+
 static struct nvmem_cell *
 nvmem_cell_get_from_lookup(struct device *dev, const char *con_id)
 {
@@ -1350,15 +1353,24 @@ nvmem_cell_get_from_lookup(struct device *dev, const char *con_id)
 				/* Provider may not be registered yet. */
 				return ERR_CAST(nvmem);
 
+			if (nvmem_layout_module_get_optional(nvmem)) {
+				nvmem_device_put(nvmem);
+				cell = ERR_PTR(-EPROBE_DEFER);
+				break;
+			}
+
 			cell_entry = nvmem_find_cell_entry_by_name(nvmem,
 								   lookup->cell_name);
 			if (!cell_entry) {
+				nvmem_layout_module_put(nvmem);
 				nvmem_device_put(nvmem);
 				cell = ERR_PTR(-ENOENT);
 			} else {
 				cell = nvmem_create_cell(cell_entry, con_id, 0);
-				if (IS_ERR(cell))
+				if (IS_ERR(cell)) {
+					nvmem_layout_module_put(nvmem);
 					nvmem_device_put(nvmem);
+				}
 			}
 			break;
 		}
-- 
2.43.0

Re: [PATCH] nvmem: core: balance the layout module ref in nvmem_cell_get_from_lookup()

[kernel test robot]

Hi Yu,

kernel test robot noticed the following build warnings:

[auto build test WARNING on linus/master]
[also build test WARNING on v7.3 next-20261026]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Yu-Zhang/nvmem-core-balance-the-layout-module-ref-in-nvmem_cell_get_from_lookup/20261026-225709
base:   linus/master
patch link:    https://lore.kernel.org/r/20261026125709.73500-1-yuz08559%40gmail.com
patch subject: [PATCH] nvmem: core: balance the layout module ref in nvmem_cell_get_from_lookup()
config: hexagon-randconfig-1001-20261027 (https://download.01.org/0day-ci/archive/20261027/202610271602.GRxskiKw-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 186e70f4e6a1521991d2340d3d49b23b1beff11f)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261027/202610271602.GRxskiKw-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202610271602.GRxskiKw-lkp@intel.com/

All warnings (new ones prefixed by >>):

>> drivers/nvmem/core.c:1327:12: warning: function 'nvmem_layout_module_get_optional' has internal linkage but is not defined [-Wundefined-internal]
    1327 | static int nvmem_layout_module_get_optional(struct nvmem_device *nvmem);
         |            ^
   drivers/nvmem/core.c:1356:8: note: used here
    1356 |                         if (nvmem_layout_module_get_optional(nvmem)) {
         |                             ^
   1 warning generated.


vim +/nvmem_layout_module_get_optional +1327 drivers/nvmem/core.c

  1326	
> 1327	static int nvmem_layout_module_get_optional(struct nvmem_device *nvmem);
  1328	static void nvmem_layout_module_put(struct nvmem_device *nvmem);
  1329	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH] nvmem: core: balance the layout module ref in nvmem_cell_get_from_lookup()

[kernel test robot]

Hi Yu,

kernel test robot noticed the following build warnings:

[auto build test WARNING on linus/master]
[also build test WARNING on v7.3 next-20261026]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Yu-Zhang/nvmem-core-balance-the-layout-module-ref-in-nvmem_cell_get_from_lookup/20261026-225709
base:   linus/master
patch link:    https://lore.kernel.org/r/20261026125709.73500-1-yuz08559%40gmail.com
patch subject: [PATCH] nvmem: core: balance the layout module ref in nvmem_cell_get_from_lookup()
config: parisc-defconfig (https://download.01.org/0day-ci/archive/20261027/202610271703.wiO2VfuK-lkp@intel.com/config)
compiler: hppa-linux-gcc (GCC) 16.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261027/202610271703.wiO2VfuK-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202610271703.wiO2VfuK-lkp@intel.com/

All warnings (new ones prefixed by >>):

>> drivers/nvmem/core.c:1327:12: warning: 'nvmem_layout_module_get_optional' used but never defined
    1327 | static int nvmem_layout_module_get_optional(struct nvmem_device *nvmem);
         |            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


vim +/nvmem_layout_module_get_optional +1327 drivers/nvmem/core.c

  1326	
> 1327	static int nvmem_layout_module_get_optional(struct nvmem_device *nvmem);
  1328	static void nvmem_layout_module_put(struct nvmem_device *nvmem);
  1329	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

[PATCH v2] nvmem: core: balance the layout module ref in nvmem_cell_get_from_lookup()

[Yu Zhang]

nvmem_cell_put() unconditionally calls nvmem_layout_module_put(), which
does module_put() on the layout driver module when nvmem->layout is set.
of_nvmem_cell_get() balances that with nvmem_layout_module_get_optional(),
but nvmem_cell_get_from_lookup() - the non-DT lookup-table path - does
not take the reference.

A consumer that resolves a cell of a layout-backed nvmem device through a
cell lookup table therefore drops a layout-module reference it never
took. That underflows the layout driver's module refcount and can let the
module be unloaded while still referenced.

Take the layout module reference on the lookup path as well, releasing it
on the error paths, mirroring of_nvmem_cell_get().

Signed-off-by: Yu Zhang <yuz08559@gmail.com>
---
v2: nvmem_layout_module_get_optional() was defined inside the
    CONFIG_OF block, but the new call site in
    nvmem_cell_get_from_lookup() is compiled unconditionally, so v1
    broke the build on CONFIG_OF=n ("used but never defined",
    reported by the kernel test robot). Move the helper out of the
    CONFIG_OF block, next to its already-unconditional sibling
    nvmem_layout_module_put(); it references no OF-specific symbols.
    The v1 fix itself is unchanged.
    Closes: https://lore.kernel.org/oe-kbuild-all/202610271703.wiO2VfuK-lkp@intel.com/
    Closes: https://lore.kernel.org/oe-kbuild-all/202610271602.GRxskiKw-lkp@intel.com/

 drivers/nvmem/core.c | 38 +++++++++++++++++++++++++-------------
 1 file changed, 25 insertions(+), 13 deletions(-)

diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 7d4cce8..fc26e2c 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -1324,6 +1324,9 @@ static struct nvmem_cell *nvmem_create_cell(struct nvmem_cell_entry *entry,
 	return cell;
 }
 
+static int nvmem_layout_module_get_optional(struct nvmem_device *nvmem);
+static void nvmem_layout_module_put(struct nvmem_device *nvmem);
+
 static struct nvmem_cell *
 nvmem_cell_get_from_lookup(struct device *dev, const char *con_id)
 {
@@ -1350,15 +1353,24 @@ nvmem_cell_get_from_lookup(struct device *dev, const char *con_id)
 				/* Provider may not be registered yet. */
 				return ERR_CAST(nvmem);
 
+			if (nvmem_layout_module_get_optional(nvmem)) {
+				nvmem_device_put(nvmem);
+				cell = ERR_PTR(-EPROBE_DEFER);
+				break;
+			}
+
 			cell_entry = nvmem_find_cell_entry_by_name(nvmem,
 								   lookup->cell_name);
 			if (!cell_entry) {
+				nvmem_layout_module_put(nvmem);
 				nvmem_device_put(nvmem);
 				cell = ERR_PTR(-ENOENT);
 			} else {
 				cell = nvmem_create_cell(cell_entry, con_id, 0);
-				if (IS_ERR(cell))
+				if (IS_ERR(cell)) {
+					nvmem_layout_module_put(nvmem);
 					nvmem_device_put(nvmem);
+				}
 			}
 			break;
 		}
@@ -1373,6 +1385,18 @@ static void nvmem_layout_module_put(struct nvmem_device *nvmem)
 		module_put(nvmem->layout->dev.driver->owner);
 }
 
+static int nvmem_layout_module_get_optional(struct nvmem_device *nvmem)
+{
+	if (!nvmem->layout)
+		return 0;
+
+	if (!nvmem->layout->dev.driver ||
+	    !try_module_get(nvmem->layout->dev.driver->owner))
+		return -EPROBE_DEFER;
+
+	return 0;
+}
+
 #if IS_ENABLED(CONFIG_OF)
 static struct nvmem_cell_entry *
 nvmem_find_cell_entry_by_node(struct nvmem_device *nvmem, struct device_node *np)
@@ -1389,18 +1413,6 @@ nvmem_find_cell_entry_by_node(struct nvmem_device *nvmem, struct device_node *np
 	return NULL;
 }
 
-static int nvmem_layout_module_get_optional(struct nvmem_device *nvmem)
-{
-	if (!nvmem->layout)
-		return 0;
-
-	if (!nvmem->layout->dev.driver ||
-	    !try_module_get(nvmem->layout->dev.driver->owner))
-		return -EPROBE_DEFER;
-
-	return 0;
-}
-
 /**
  * of_nvmem_cell_get() - Get a nvmem cell from given device node and cell id
  *
-- 
2.55.0