From patchwork Mon Oct 24 11:30:31 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 8938 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp435076wru; Mon, 24 Oct 2022 05:53:36 -0700 (PDT) X-Google-Smtp-Source: AMsMyM4tD6CM8p2nyIRI+kcRwdsyBGWrjY7aAoTghVQicadpPUZV4j6obPScT99YDML+kTygBxfE X-Received: by 2002:a17:907:2d2c:b0:78d:d289:7efd with SMTP id gs44-20020a1709072d2c00b0078dd2897efdmr27367628ejc.166.1666616006031; Mon, 24 Oct 2022 05:53:26 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666616006; cv=none; d=google.com; s=arc-20160816; b=tTMSwQEtsuOpO7HvB8n6/0f1kPN8M70qVt4a/dwfmYnKx+F9iCulibqhQV5alr1617 HZxjn6s2ACqdrWsPHon/HbcvEC2igrs2/QTwrZHtN8xtjrxww9HUQkoX9g+hgQC4t4vv 9Kg62Xrx+AejKYBLUdMLrPqtiNx/0GHZbmH8AwLAHnYB6AadYKcTJqVcoz6NY2JjzbQD CiDAG8G3hc+wKdRYxN8fAVyy8ONgPLZCp0SGWseAYFNwqX0JperWiEJ3BNGDDp1zxOBJ DnPiT03dBUNLrMUa3RcoU4Qp5lXbL2IlKwHOtBtccQ6JFKLOfe4YbfVLqazP3GoXU/O7 Qn4A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=/1pGYtS/gl7QoouyJOduH+kH6PG5VVjn57xl2e4TFk0=; b=pfShO2dMfC6MfFdpEd5TO3Dx0kowNY8cLkFTDLQ0r7R8AcpNpIPNFhYdchiZgONw7u qCrQJE4zZNx6D33i1i1rDz4VnyjGVuEQVmvHTpuyla33GyTgx+gVwbJ2gOBIWnHUhW51 RsXmCPCZVHSSWc6TkN9Czm/fFS2e4yJ5C8mEg9qRppPGjMS8SVa+xQ6ah572/JNE3aFA r+mlUsE+R4Eq8xTVGFnNK368pIGIddkfyfFZFCsIv70ikVZzYBKv23rBkMCVSRl4hH6s VVtJ176zepuvh0ue7s2fLwWGdFjJaFBuW/CA+IMsJ9IN9URKUXXOWL2XOiB/EloYafEs +Mxw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=DthsHNDk; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id oz41-20020a1709077da900b00782a33f2850si27904776ejc.736.2022.10.24.05.53.01; Mon, 24 Oct 2022 05:53:26 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=DthsHNDk; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234335AbiJXMwJ (ORCPT + 99 others); Mon, 24 Oct 2022 08:52:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58770 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234837AbiJXMpv (ORCPT ); Mon, 24 Oct 2022 08:45:51 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5B5726AA24; Mon, 24 Oct 2022 05:10:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 04B5461254; Mon, 24 Oct 2022 12:10:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1BBAEC43470; Mon, 24 Oct 2022 12:10:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666613416; bh=jGjZlBQPhcH9jQ0Rm5yLEnHk8aUsn/4zCK9ghfgiHIs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DthsHNDkaDd9hAt9vkG/uy37tavNj9wzEkQ+y87nSWidEfz4sgX19oXJ7PbF/iEEN zWFLnjKMqsBwWDp9/yArBoLf6qCdH9WAFJaqNrds52g+F7Ox/M2DOO3jW2huurzjl8 6kZyJQphWwpm9J77PqJHwJI1YjULWAV3y7n+6TaI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?utf-8?q?Nuno_S=C3=A1?= , Jonathan Cameron , Sasha Levin Subject: [PATCH 5.4 121/255] iio: inkern: only release the device node when done with it Date: Mon, 24 Oct 2022 13:30:31 +0200 Message-Id: <20221024113006.568093359@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221024113002.471093005@linuxfoundation.org> References: <20221024113002.471093005@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.6 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747573545105465840?= X-GMAIL-MSGID: =?utf-8?q?1747573545105465840?= From: Nuno Sá [ Upstream commit 79c3e84874c7d14f04ad58313b64955a0d2e9437 ] 'of_node_put()' can potentially release the memory pointed to by 'iiospec.np' which would leave us with an invalid pointer (and we would still pass it in 'of_xlate()'). Note that it is not guaranteed for the of_node lifespan to be attached to the device (to which is attached) lifespan so that there is (even though very unlikely) the possibility for the node to be freed while the device is still around. Thus, as there are indeed some of_xlate users which do access the node, a race is indeed possible. As such, we can only release the node after we are done with it. Fixes: 17d82b47a215d ("iio: Add OF support") Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20220715122903.332535-2-nuno.sa@analog.com Signed-off-by: Jonathan Cameron Signed-off-by: Sasha Levin --- drivers/iio/inkern.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c index ca0fe902a7db..d00f3045557c 100644 --- a/drivers/iio/inkern.c +++ b/drivers/iio/inkern.c @@ -136,9 +136,10 @@ static int __of_iio_channel_get(struct iio_channel *channel, idev = bus_find_device(&iio_bus_type, NULL, iiospec.np, iio_dev_node_match); - of_node_put(iiospec.np); - if (idev == NULL) + if (idev == NULL) { + of_node_put(iiospec.np); return -EPROBE_DEFER; + } indio_dev = dev_to_iio_dev(idev); channel->indio_dev = indio_dev; @@ -146,6 +147,7 @@ static int __of_iio_channel_get(struct iio_channel *channel, index = indio_dev->info->of_xlate(indio_dev, &iiospec); else index = __of_iio_simple_xlate(indio_dev, &iiospec); + of_node_put(iiospec.np); if (index < 0) goto err_put; channel->channel = &indio_dev->channels[index];