linux-kernel - Re: [PATCH v2 5/9] mtd: nand: atmel: fix OF child-node lookup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 27 Aug 2018 10:28:20 +0200
From:   Boris Brezillon <boris.brezillon@...tlin.com>
To:     Johan Hovold <johan@...nel.org>
Cc:     Rob Herring <robh+dt@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Frank Rowand <frowand.list@...il.com>,
        devicetree@...r.kernel.org, linux-kernel@...r.kernel.org,
        stable <stable@...r.kernel.org>,
        Nicolas Ferre <nicolas.ferre@...rochip.com>,
        Josh Wu <rainyfeeling@...look.com>
Subject: Re: [PATCH v2 5/9] mtd: nand: atmel: fix OF child-node lookup

Hi Johan

On Mon, 27 Aug 2018 10:21:49 +0200
Johan Hovold <johan@...nel.org> wrote:

> Use the new of_get_compatible_child() helper to lookup the nfc child
> node instead of using of_find_compatible_node(), which searches the
> entire tree from a given start node and thus can return an unrelated
> (i.e. non-child) node.
> 
> This also addresses a potential use-after-free (e.g. after probe
> deferral) as the tree-wide helper drops a reference to its first
> argument (i.e. the node of the device being probed).
> 
> While at it, also fix a related nfc-node reference leak.
> 
> Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver")
> Cc: stable <stable@...r.kernel.org>     # 4.11
> Cc: Nicolas Ferre <nicolas.ferre@...rochip.com>
> Cc: Josh Wu <rainyfeeling@...look.com>
> Cc: Boris Brezillon <boris.brezillon@...tlin.com>
> Signed-off-by: Johan Hovold <johan@...nel.org>

Acked-by: Boris Brezillon <boris.brezillon@...tlin.com>

I'll let Miquel queue this patch to the nand/next branch, unless you
want it to be merged in 4.19, in which case I'll queue it to the
mtd/fixes branch.

Thanks,

Boris

> ---
>  drivers/mtd/nand/raw/atmel/nand-controller.c | 11 +++++++----
>  1 file changed, 7 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
> index a068b214ebaa..d3dfe63956ac 100644
> --- a/drivers/mtd/nand/raw/atmel/nand-controller.c
> +++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
> @@ -2061,8 +2061,7 @@ atmel_hsmc_nand_controller_legacy_init(struct atmel_hsmc_nand_controller *nc)
>  	int ret;
>  
>  	nand_np = dev->of_node;
> -	nfc_np = of_find_compatible_node(dev->of_node, NULL,
> -					 "atmel,sama5d3-nfc");
> +	nfc_np = of_get_compatible_child(dev->of_node, "atmel,sama5d3-nfc");
>  
>  	nc->clk = of_clk_get(nfc_np, 0);
>  	if (IS_ERR(nc->clk)) {
> @@ -2472,15 +2471,19 @@ static int atmel_nand_controller_probe(struct platform_device *pdev)
>  	}
>  
>  	if (caps->legacy_of_bindings) {
> +		struct device_node *nfc_node;
>  		u32 ale_offs = 21;
>  
>  		/*
>  		 * If we are parsing legacy DT props and the DT contains a
>  		 * valid NFC node, forward the request to the sama5 logic.
>  		 */
> -		if (of_find_compatible_node(pdev->dev.of_node, NULL,
> -					    "atmel,sama5d3-nfc"))
> +		nfc_node = of_get_compatible_child(pdev->dev.of_node,
> +						   "atmel,sama5d3-nfc");
> +		if (nfc_node) {
>  			caps = &atmel_sama5_nand_caps;
> +			of_node_put(nfc_node);
> +		}
>  
>  		/*
>  		 * Even if the compatible says we are dealing with an