From patchwork Wed Sep 20 18:09:10 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Torokhov X-Patchwork-Id: 142616 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:612c:172:b0:3f2:4152:657d with SMTP id h50csp4439605vqi; Wed, 20 Sep 2023 14:34:09 -0700 (PDT) X-Google-Smtp-Source: AGHT+IHhZXE1GRPm759wnPliCpN1zgyu1vZFedsYNWBv6uI/sNdaveGET1/2LItsV8vQ7bqjbFYs X-Received: by 2002:a05:6a20:ce9c:b0:137:30db:bc35 with SMTP id if28-20020a056a20ce9c00b0013730dbbc35mr3454745pzb.27.1695245649738; Wed, 20 Sep 2023 14:34:09 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1695245649; cv=none; d=google.com; s=arc-20160816; b=Pz/lihyxFhRVL12uY8mWzUmkFXBJ0nCHhbifkUgzsdbp5PTd/wqb1XArhZaHKTJ3LX gy5YQkRAh5M2yIs58YcN0S0bbudcNCiWI+zWlLBp+6fBEXbEdHYBUeae4gs8f1umo//z uBXuaAVIXZiBOZAiw9Nz0m50yUZMh0kUO2tbk7+yzWMcFvE1B38wiag6jievB8uDpSA+ XrZRJ0LOTXcR4RwzFHdpqcx7rly5JrmMgMJJOcjfPNCJDOszRqsdtPng9+IPQBAphAA+ rYXk7gK2MFUQKs5aLTDbRUH6o/fMOeeG7MsfbmP5jojoAJd7Z90o07S6lMugKYXbR3oW 2QkQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-disposition:mime-version:message-id :subject:cc:to:from:date:dkim-signature; bh=B/lu8BcHJ/ysOPQIAbugBzzumndKD9GUIWEsPV6mHQU=; fh=KTa/jrp4NTSVA7nCpRztpMFgP0vdA4FueRYZjfd0Uzc=; b=p/NRozcFgesZTXsHlaBqJCQUWqy8yY0h4QLP9lczovp1cuhP/muHY0wrlsHdC7gTw6 8uCFoDh/4wf8MWeFxDGg/VPb1+namxZAZ3EwQXTGURhxpbldY5LGX25Y8U4UyGp2G74k TOy37mxynwkcBSgIffM7RG1I/VCDWODR4hujZ2nYHz+liLpESe+2qTNpRHTaxfre91wM BuKEScLmlMxQRQNyjX750iUdRRXHsUKKf56awmU3T8zdZiI6s4PRJ462lFTjFbLftyON wXgohjkOY7I+KfPaLwQPVXf8RbKnmjoyOW8DFrnhgkKwAZwqi0frtbVS/JCEmwaUtPVu lvbQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20230601 header.b=ATLStUVa; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.32 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from agentk.vger.email (agentk.vger.email. [23.128.96.32]) by mx.google.com with ESMTPS id g23-20020a17090adb1700b0026f75d932a8si100784pjv.185.2023.09.20.14.34.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 20 Sep 2023 14:34:09 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.32 as permitted sender) client-ip=23.128.96.32; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20230601 header.b=ATLStUVa; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.32 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by agentk.vger.email (Postfix) with ESMTP id E36BF81CFEB5; Wed, 20 Sep 2023 11:09:57 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at agentk.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229688AbjITSJ0 (ORCPT + 27 others); Wed, 20 Sep 2023 14:09:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56898 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229663AbjITSJT (ORCPT ); Wed, 20 Sep 2023 14:09:19 -0400 Received: from mail-pj1-x102a.google.com (mail-pj1-x102a.google.com [IPv6:2607:f8b0:4864:20::102a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 07DD2D6; Wed, 20 Sep 2023 11:09:14 -0700 (PDT) Received: by mail-pj1-x102a.google.com with SMTP id 98e67ed59e1d1-274b01849c4so11531a91.3; Wed, 20 Sep 2023 11:09:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1695233353; x=1695838153; darn=vger.kernel.org; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :from:to:cc:subject:date:message-id:reply-to; bh=B/lu8BcHJ/ysOPQIAbugBzzumndKD9GUIWEsPV6mHQU=; b=ATLStUVarJQARDf6LuL8kZwydKTbXAQ/6pcLEDT6yWMNTYVEZAbSuvl+NcGXPh/Vhp EmyweuFZXm9EC2M8uc/0aqzwLWxNL7UpgW/QgpgePqy+oHTtRIkn5+ZiPi0d9W0bkZ+m jQD/11Yv3UeXNmsy6gh332yjYvX8OSOjgEBDVqVvvWq9phGC1gtYsMSiEW441P9AW+/T g/twWg3sdks6xOMMMh8+HFdJPRMa3ptxor9mCfFTx0Pq8vwgKCVpg+zyfq4gZwO1olw0 prjXtJr5kVMMKeOevSLOQqOdz4cVQktcDk5J6oVmBAEzz3qQXMIW9h3imbl4hqkwazHJ IgxA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1695233353; x=1695838153; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=B/lu8BcHJ/ysOPQIAbugBzzumndKD9GUIWEsPV6mHQU=; b=CMnzmgpuJx1oX1LooHioviSyNvbWCwXVKQbcEf3VumK2LyaOWSgibbaDwYB4TEUFmH h+SDeQ8CFDUYg0116uVVYTmCjSmYLRftDjyAOM/3igtSlMzO+CBUjVUNtNie7DDYuupT IrkOyX1UIC3JeM/mR8tBbqjJ7pBMMIMoPbE2OKmlhPi8JKz/lEIO2jeEnN+DjxdTJwvL k0AyEiHJkSI0ARlMS8MYRYPAsyItLATnk28+uNu/u8jmDad6YIeqXSE1N3DtJT/7eonS TyBLgjFi2ev8EF+IiGM3nVuauizFQTu0A7s9S+l336cgvIUt0XQUXGQ9pkAf6HMSqPaD 9gKg== X-Gm-Message-State: AOJu0Ywjl5m5eQfrZsissj4JiRq+qbTwGdgD7cRl1LAs3s149UpYMdA+ JRvs4kWoeTn+5gM3SyZudCY= X-Received: by 2002:a17:90a:3ec6:b0:268:29cf:3231 with SMTP id k64-20020a17090a3ec600b0026829cf3231mr3278194pjc.3.1695233353165; Wed, 20 Sep 2023 11:09:13 -0700 (PDT) Received: from google.com ([2620:15c:9d:2:3073:3a17:4a3d:2738]) by smtp.gmail.com with ESMTPSA id v13-20020a17090ac90d00b002639c4f81cesm1632455pjt.3.2023.09.20.11.09.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 20 Sep 2023 11:09:12 -0700 (PDT) Date: Wed, 20 Sep 2023 11:09:10 -0700 From: Dmitry Torokhov To: Linus Walleij Cc: Bartosz Golaszewski , linux-gpio@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] pinctrl: avoid unsafe code pattern in find_pinctrl() Message-ID: MIME-Version: 1.0 Content-Disposition: inline X-Spam-Status: No, score=-0.6 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on agentk.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (agentk.vger.email [0.0.0.0]); Wed, 20 Sep 2023 11:09:57 -0700 (PDT) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1777593902520286832 X-GMAIL-MSGID: 1777593902520286832 The code in find_pinctrl() takes a mutex and traverses a list of pinctrl structures. Later the caller bumps up reference count on the found structure. Such pattern is not safe as pinctrl that was found may get deleted before the caller gets around to increasing the reference count. Fix this by taking the reference count in find_pinctrl(), while it still holds the mutex. Signed-off-by: Dmitry Torokhov --- drivers/pinctrl/core.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c index e9dc9638120a..e2f7519bef04 100644 --- a/drivers/pinctrl/core.c +++ b/drivers/pinctrl/core.c @@ -1022,17 +1022,20 @@ static int add_setting(struct pinctrl *p, struct pinctrl_dev *pctldev, static struct pinctrl *find_pinctrl(struct device *dev) { - struct pinctrl *p; + struct pinctrl *entry, *p = NULL; mutex_lock(&pinctrl_list_mutex); - list_for_each_entry(p, &pinctrl_list, node) - if (p->dev == dev) { - mutex_unlock(&pinctrl_list_mutex); - return p; + + list_for_each_entry(entry, &pinctrl_list, node) { + if (entry->dev == dev) { + p = entry; + kref_get(&p->users); + break; } + } mutex_unlock(&pinctrl_list_mutex); - return NULL; + return p; } static void pinctrl_free(struct pinctrl *p, bool inlist); @@ -1140,7 +1143,6 @@ struct pinctrl *pinctrl_get(struct device *dev) p = find_pinctrl(dev); if (p) { dev_dbg(dev, "obtain a copy of previously claimed pinctrl\n"); - kref_get(&p->users); return p; }