From patchwork Mon Oct 24 11:30:38 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 8839 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp431567wru; Mon, 24 Oct 2022 05:44:12 -0700 (PDT) X-Google-Smtp-Source: AMsMyM4KACxD/ETlXEFdM4Xj3LzVm5xVGadw62Kxm+r/193fgkbWpDEOrrSYw0IBgUDDSxAqQxOe X-Received: by 2002:a17:907:7251:b0:7a5:a8f5:b86e with SMTP id ds17-20020a170907725100b007a5a8f5b86emr6239069ejc.761.1666615452372; Mon, 24 Oct 2022 05:44:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666615452; cv=none; d=google.com; s=arc-20160816; b=WGNEmb6Wz4WdPeA4pyNbcfb6SCoyimRCp4GoPdn3i+hnOucB/at0Y3tdRTH3BG/bs3 ofP/FuFVVZ/42xxh469qIQltYT6v1TgDMYCyLDL31es7wQSlJ0oxN5R1Oo34TTgcf+Xx v+LG3P9vjmeKvhg0UQHEF5q9jdTlYPUfjTWqsB/CjqXDWTTYzv2TsG5Sx9lo53a3g6oX Cb5QkWg3ZhW3gxmWE0G5LzplCGUMQNBJUkvXq5YQOD0WeuaBjEzmOFOWakRIDKekDal+ ExNic8KGS+hyMxpkWzew18RHMKW3ZDRqov27fQqNKCs91QxNznkJgoAWCtoPZi7ZqNnj SkCQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=jRQqcoJ/abor/HzKWzFeCx+0YUB34os0T5TJVweUyyA=; b=sNFHQkshz9eyQhxQuvEXzMJqCiFSK6rBp/64YwQQ8kezxw7NiHEZb7vm/nXWSCo5kO 2JNdUgfdnJHo1jxkWZQpzCGNPsNlK9qrifhfZ/OVR5hgQa05QtdU8RBK2+cPD5palN59 qJeiDmDytTAJyjHDZrjSMpqaKiLWboAOIphDe+bhgUv6jOKpDnque6RP8TPlglgei8k8 bPtXJUaz9JcxiMRTAcN0zaQgztsF8XUZHv1fFBF7pJ4V7HJk56ajciPhAo/7KVALdiDk 7DcGTdWrJ4UH9vaSAnjVRyRrHIksEpnpKKpd5t8yKtY8+R9UjfCaNIXuETCUfdyA1i+b niiQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b="qLFw5H/g"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id mc10-20020a170906eb4a00b00767e24156dbsi24237812ejb.256.2022.10.24.05.43.46; Mon, 24 Oct 2022 05:44:12 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b="qLFw5H/g"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234711AbiJXMfq (ORCPT + 99 others); Mon, 24 Oct 2022 08:35:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53824 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234269AbiJXM3y (ORCPT ); Mon, 24 Oct 2022 08:29:54 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 524B7CE16; Mon, 24 Oct 2022 05:03:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6CA10B8118A; Mon, 24 Oct 2022 12:01:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BB52DC433C1; Mon, 24 Oct 2022 12:01:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666612870; bh=pMoeHjQy/ObZ8+wueUd63+e+HB70jsgojMHn/4MTjLQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qLFw5H/gNC8HsFyt409AxqOunqP7Vj7NI2YnHCxyqOEDxui1+qw2tLohJ906PSZse PodRr9x/wfrvu1OZPIMvNqs89Y6oK0t3lmriFbWI+rQ1vi4e7aaRjpJJNbWCDmeJoF T4BHOKGAJ6jPxklOIr3sln2y8+QAb/ZbSgWt2eoI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?utf-8?q?Nuno_S=C3=A1?= , Jonathan Cameron , Sasha Levin Subject: [PATCH 4.19 119/229] iio: inkern: only release the device node when done with it Date: Mon, 24 Oct 2022 13:30:38 +0200 Message-Id: <20221024113002.840760071@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221024112959.085534368@linuxfoundation.org> References: <20221024112959.085534368@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.6 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747572964594506269?= X-GMAIL-MSGID: =?utf-8?q?1747572964594506269?= From: Nuno Sá [ Upstream commit 79c3e84874c7d14f04ad58313b64955a0d2e9437 ] 'of_node_put()' can potentially release the memory pointed to by 'iiospec.np' which would leave us with an invalid pointer (and we would still pass it in 'of_xlate()'). Note that it is not guaranteed for the of_node lifespan to be attached to the device (to which is attached) lifespan so that there is (even though very unlikely) the possibility for the node to be freed while the device is still around. Thus, as there are indeed some of_xlate users which do access the node, a race is indeed possible. As such, we can only release the node after we are done with it. Fixes: 17d82b47a215d ("iio: Add OF support") Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20220715122903.332535-2-nuno.sa@analog.com Signed-off-by: Jonathan Cameron Signed-off-by: Sasha Levin --- drivers/iio/inkern.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c index a8ccc6e5a773..5108b0504616 100644 --- a/drivers/iio/inkern.c +++ b/drivers/iio/inkern.c @@ -139,9 +139,10 @@ static int __of_iio_channel_get(struct iio_channel *channel, idev = bus_find_device(&iio_bus_type, NULL, iiospec.np, iio_dev_node_match); - of_node_put(iiospec.np); - if (idev == NULL) + if (idev == NULL) { + of_node_put(iiospec.np); return -EPROBE_DEFER; + } indio_dev = dev_to_iio_dev(idev); channel->indio_dev = indio_dev; @@ -149,6 +150,7 @@ static int __of_iio_channel_get(struct iio_channel *channel, index = indio_dev->info->of_xlate(indio_dev, &iiospec); else index = __of_iio_simple_xlate(indio_dev, &iiospec); + of_node_put(iiospec.np); if (index < 0) goto err_put; channel->channel = &indio_dev->channels[index];