linux-kernel - Re: [PATCH v2 6/9] net: bcmgenet: fix OF child-node lookup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 4 Sep 2018 14:56:24 +0200
From:   Johan Hovold <johan@...nel.org>
To:     Florian Fainelli <f.fainelli@...il.com>
Cc:     Johan Hovold <johan@...nel.org>, Rob Herring <robh+dt@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Frank Rowand <frowand.list@...il.com>,
        devicetree@...r.kernel.org, linux-kernel@...r.kernel.org,
        stable <stable@...r.kernel.org>,
        "David S . Miller" <davem@...emloft.net>
Subject: Re: [PATCH v2 6/9] net: bcmgenet: fix OF child-node lookup

On Thu, Aug 30, 2018 at 05:47:33PM -0700, Florian Fainelli wrote:
> On 08/27/2018 01:21 AM, Johan Hovold wrote:
> > Use the new of_get_compatible_child() helper to lookup the mdio child
> > node instead of using of_find_compatible_node(), which searches the
> > entire tree from a given start node and thus can return an unrelated
> > (i.e. non-child) node.
> > 
> > This also addresses a potential use-after-free (e.g. after probe
> > deferral) as the tree-wide helper drops a reference to its first
> > argument (i.e. the node of the device being probed).
> > 
> > Fixes: aa09677cba42 ("net: bcmgenet: add MDIO routines")
> > Cc: stable <stable@...r.kernel.org>     # 3.15
> > Cc: Florian Fainelli <f.fainelli@...il.com>
> > Cc: David S. Miller <davem@...emloft.net>
> > Signed-off-by: Johan Hovold <johan@...nel.org>
> 
> Reviewed-by: Florian Fainelli <f.fainelli@...il.com>

Thanks for reviewing.

Rob's gotten the helper into -rc2:

	36156f9241cb of: add helper to lookup compatible child node

so feel free to pick this one up directly to whichever net tree you
prefer. I've been able to trigger crashes after probe deferrals due to
the use-after-free, but this seems unlikely to be exploitable.

Thanks,
Johan