From patchwork Mon Oct 24 11:30:44 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 8433 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp400990wru; Mon, 24 Oct 2022 04:48:00 -0700 (PDT) X-Google-Smtp-Source: AMsMyM5tguQOxfbGm8VYU4vHvQ5pM9kiq1HLWrafm+eFhzeFSKWe95DLYlbhfQJKtv5tGNDDX1mS X-Received: by 2002:a17:907:7e87:b0:78e:2dc3:945 with SMTP id qb7-20020a1709077e8700b0078e2dc30945mr27380135ejc.326.1666612080614; Mon, 24 Oct 2022 04:48:00 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666612080; cv=none; d=google.com; s=arc-20160816; b=iLImX6goFPyJea8mv8ZMkgJj1KviPTWDn6lKlR7iy/NYY/eYLW5ANVKdYm+ZanBCkf F996bB7AwgITPamlwW7o77rHQmvoczsNSzXad8Rk4+Qkaeu/XuS6QrtCB+bfAngtnCeY fvXB9hV7v72Ty5TxxG0oq3f68cKbR9eQPSXjZFyDYCPyvr6xwP71+J8kXV+ccZDlU8Cr Ppjh9WDEGiypuT+Twb4DjN2xRNplyZJ6vOeqOGsGskqnQjVghT2/GWWgvPz4K9DFHrEi sldHnqTK2xVMr8EJFev5NWcK/jbQt0FRyzEvou47KZ8A05hPaKR8HJ+pwd5B8rWyoO/a 3Esw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=d23vvNpdgp5i/T7gptyao9Q8tmu8XcfgE2nNbUnfCMw=; b=kJ1ZqO/0klBz50rnxG7fhhSZ9ZzXFrwxLTmfnxgdsCben6MWZGYnPiuJocpI8NZh6p I1aNZyAUb5TdYeSCgJYV9fdZuJMPQt8BeFE1+UDJe2xsL7GxIgTw/mLlhXJ3BkqQ8sfx HIKpLsNJLHqw8CVVQYfpA0er4TfYhqDBwMPOpjwCA7t9R4Ac+NAwoHxpRFpmeEtK0wK/ 3GHa20PAVu2WMSuRCXMjve/FswJOWj60yvPAMovKNsU5NZoC/bmcMB5OpPOZf+574AW3 3sFOb8HikSbCQTP12X0R0hs3OOIwhcrBCFpXqtZtF6FUa2P/dNzF9EgQcn3x/HhukATW To4Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=uv7jn1bx; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id q13-20020a056402518d00b0045e00384e8asi18925653edd.380.2022.10.24.04.47.37; Mon, 24 Oct 2022 04:48:00 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=uv7jn1bx; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231660AbiJXLrD (ORCPT + 99 others); Mon, 24 Oct 2022 07:47:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46618 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230219AbiJXLpK (ORCPT ); Mon, 24 Oct 2022 07:45:10 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6726F1CB21; Mon, 24 Oct 2022 04:42:33 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B005AB8115E; Mon, 24 Oct 2022 11:42:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 12C3DC433C1; Mon, 24 Oct 2022 11:42:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666611731; bh=K1rFR5/EOtnA9W1cWqlMP/EGYwolFkZjTI4Y9jSRlQc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uv7jn1bxZkk5IONjvbFm8tAomZzknAkiwIraEl9fFKGGDMHDRGV8X254MeCDABM/w 62BR8RA2lPeKNrs6YRwaNuUCfYlsWKzXJmhIU8/kdQJCzEkMmBvKSNz2tbicnx0FZK Y51FVgitOuoLE9X90KScH44IPfUIVW1bJz9m03t0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?utf-8?q?Nuno_S=C3=A1?= , Jonathan Cameron , Sasha Levin Subject: [PATCH 4.9 090/159] iio: inkern: only release the device node when done with it Date: Mon, 24 Oct 2022 13:30:44 +0200 Message-Id: <20221024112952.701629645@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221024112949.358278806@linuxfoundation.org> References: <20221024112949.358278806@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.6 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747569428827843919?= X-GMAIL-MSGID: =?utf-8?q?1747569428827843919?= From: Nuno Sá [ Upstream commit 79c3e84874c7d14f04ad58313b64955a0d2e9437 ] 'of_node_put()' can potentially release the memory pointed to by 'iiospec.np' which would leave us with an invalid pointer (and we would still pass it in 'of_xlate()'). Note that it is not guaranteed for the of_node lifespan to be attached to the device (to which is attached) lifespan so that there is (even though very unlikely) the possibility for the node to be freed while the device is still around. Thus, as there are indeed some of_xlate users which do access the node, a race is indeed possible. As such, we can only release the node after we are done with it. Fixes: 17d82b47a215d ("iio: Add OF support") Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20220715122903.332535-2-nuno.sa@analog.com Signed-off-by: Jonathan Cameron Signed-off-by: Sasha Levin --- drivers/iio/inkern.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c index 218cf4567ab5..13be4c8d7fd3 100644 --- a/drivers/iio/inkern.c +++ b/drivers/iio/inkern.c @@ -139,9 +139,10 @@ static int __of_iio_channel_get(struct iio_channel *channel, idev = bus_find_device(&iio_bus_type, NULL, iiospec.np, iio_dev_node_match); - of_node_put(iiospec.np); - if (idev == NULL) + if (idev == NULL) { + of_node_put(iiospec.np); return -EPROBE_DEFER; + } indio_dev = dev_to_iio_dev(idev); channel->indio_dev = indio_dev; @@ -149,6 +150,7 @@ static int __of_iio_channel_get(struct iio_channel *channel, index = indio_dev->info->of_xlate(indio_dev, &iiospec); else index = __of_iio_simple_xlate(indio_dev, &iiospec); + of_node_put(iiospec.np); if (index < 0) goto err_put; channel->channel = &indio_dev->channels[index];