From patchwork Mon Oct 24 11:30:32 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 8624 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp420382wru; Mon, 24 Oct 2022 05:18:05 -0700 (PDT) X-Google-Smtp-Source: AMsMyM5mXQIIZpjKSO5e1PKiqVKxjbmeXVn+ahFsPq+LUKRgiKEZDUxjojyVPWYkQpXIRlrtP8Jm X-Received: by 2002:a17:907:75d1:b0:7a8:291:2050 with SMTP id jl17-20020a17090775d100b007a802912050mr4107646ejc.287.1666613885499; Mon, 24 Oct 2022 05:18:05 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666613885; cv=none; d=google.com; s=arc-20160816; b=z624FwXcVra1WhnEQz8WAg7/uvzVCSVafUQJXrFH3GZnPJRJeVmBl8LwCKkSuzL/I3 9C+LaWZWH5R9XtHLBQ2/sO37DCcXK2BCtOzDSQvlsjl35JUTcpRLN3tPoSpXzfHmMEyy sX8widMG1PR+GBjvjet5u/DWCmRvLY9QcaU4cwQJxnYVEGhyfZA33aCzEXJeJQHgFsvU czW17tvV3R8mCWPchZAj2jRhuIJOMmWTtMtQB9NOZu0vC+rdJ/2+EeKD8zBeCmnqZ2bP sz4/ATRRYmH6x8QwRsGQKF5FapaV2lUjDAZv+VfgsnUbsPecoyxHtf8V5YD2F98EXnJD vGRw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=ezMjh/bLbyfKIwo18TDU1ekMpi4tfHNXvXwW2RWkiPI=; b=dJBg6rihNf44gnIL2pkxIT/ytjfXWiEdO2+yjWu/cC69SEKeVXmfdHY9d2ySZ1rz2a w5dQjlcK2jVYES1J4s7t0KOIjDtyx1Sv2L9Hk16f5muW6agYjNKofsSXjOGNXQSrEY0r cUU8eyYwvRTM2iucYiyrt9vcbCFKxKvCqkXVqT7jNM9lW690E36/1sJfBtqUhhYamIgu pPRuQW2bxX51uEM/G/51IA5ce3LV9t+3mX6eZBqYhz2xI9P1wyWr+SwnIuFxvPuFYjj5 qumJXOESDEthI3R4P+B3E6J/Wk/PE5hLg6eVamI8clTeEGWHcBzGIvYCELKySxzaWXbe eR3A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=jQyQUsQP; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id sb24-20020a1709076d9800b007815a44de91si30113779ejc.771.2022.10.24.05.17.41; Mon, 24 Oct 2022 05:18:05 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=jQyQUsQP; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232893AbiJXMLc (ORCPT + 99 others); Mon, 24 Oct 2022 08:11:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60164 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229947AbiJXMKB (ORCPT ); Mon, 24 Oct 2022 08:10:01 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9BCC380496; Mon, 24 Oct 2022 04:53:35 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id F12656122D; Mon, 24 Oct 2022 11:50:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0BF66C433C1; Mon, 24 Oct 2022 11:50:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666612218; bh=DC0BF9IcilZ6vNyknUu5VstpmDbJb6Kcs0pf3U3tFKo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jQyQUsQPQ2qBKheLWxj8W3Jd+OPN1OLuj9HYJ2Vvi9itN2M48bhnzeFMje+18KWOk NDbdNbT1cZ75ule69pmj402F7ZxpBytXxUtiPz1fFLiMRoEui9t/4MD9j2UIkKWLf8 oQlJqKCD3d4fcnEAFVtePKm4+LlXfvM5U/xM1zLM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?utf-8?q?Nuno_S=C3=A1?= , Jonathan Cameron , Sasha Levin Subject: [PATCH 4.14 115/210] iio: inkern: only release the device node when done with it Date: Mon, 24 Oct 2022 13:30:32 +0200 Message-Id: <20221024113000.724877639@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221024112956.797777597@linuxfoundation.org> References: <20221024112956.797777597@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.6 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747571321591562605?= X-GMAIL-MSGID: =?utf-8?q?1747571321591562605?= From: Nuno Sá [ Upstream commit 79c3e84874c7d14f04ad58313b64955a0d2e9437 ] 'of_node_put()' can potentially release the memory pointed to by 'iiospec.np' which would leave us with an invalid pointer (and we would still pass it in 'of_xlate()'). Note that it is not guaranteed for the of_node lifespan to be attached to the device (to which is attached) lifespan so that there is (even though very unlikely) the possibility for the node to be freed while the device is still around. Thus, as there are indeed some of_xlate users which do access the node, a race is indeed possible. As such, we can only release the node after we are done with it. Fixes: 17d82b47a215d ("iio: Add OF support") Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20220715122903.332535-2-nuno.sa@analog.com Signed-off-by: Jonathan Cameron Signed-off-by: Sasha Levin --- drivers/iio/inkern.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c index f12bad60a581..599069b4fe5d 100644 --- a/drivers/iio/inkern.c +++ b/drivers/iio/inkern.c @@ -139,9 +139,10 @@ static int __of_iio_channel_get(struct iio_channel *channel, idev = bus_find_device(&iio_bus_type, NULL, iiospec.np, iio_dev_node_match); - of_node_put(iiospec.np); - if (idev == NULL) + if (idev == NULL) { + of_node_put(iiospec.np); return -EPROBE_DEFER; + } indio_dev = dev_to_iio_dev(idev); channel->indio_dev = indio_dev; @@ -149,6 +150,7 @@ static int __of_iio_channel_get(struct iio_channel *channel, index = indio_dev->info->of_xlate(indio_dev, &iiospec); else index = __of_iio_simple_xlate(indio_dev, &iiospec); + of_node_put(iiospec.np); if (index < 0) goto err_put; channel->channel = &indio_dev->channels[index];