linux-kernel - [PATCH] ASoC: simple-card: Fix refcount underflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 16 Feb 2019 10:09:42 +0000
From:   Daniel Baluta <daniel.baluta@....com>
To:     "kuninori.morimoto.gx@...esas.com" <kuninori.morimoto.gx@...esas.com>,
        "broonie@...nel.org" <broonie@...nel.org>,
        "vicencb@...il.com" <vicencb@...il.com>
CC:     "alsa-devel@...a-project.org" <alsa-devel@...a-project.org>,
        "tiwai@...e.com" <tiwai@...e.com>,
        "lgirdwood@...il.com" <lgirdwood@...il.com>,
        "gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        dl-linux-imx <linux-imx@....com>,
        "S.j. Wang" <shengjiu.wang@....com>,
        Daniel Baluta <daniel.baluta@....com>
Subject: [PATCH] ASoC: simple-card: Fix refcount underflow

of_get_child_by_name() takes a reference we'll need to drop
later so when we substitute in top we need to take a reference
as well as just assigning.

Without this patch we hit the following error:

[    1.246852] OF: ERROR: Bad of_node_put() on /sound-wm8524
[    1.262261] Hardware name: NXP i.MX8MQ EVK (DT)
[    1.266807] Workqueue: events deferred_probe_work_func
[    1.271950] Call trace:
[    1.274406]  dump_backtrace+0x0/0x158
[    1.278074]  show_stack+0x14/0x20
[    1.281396]  dump_stack+0xa8/0xcc
[    1.284717]  of_node_release+0xb0/0xc8
[    1.288474]  kobject_put+0x74/0xf0
[    1.291879]  of_node_put+0x14/0x28
[    1.295286]  __of_get_next_child+0x44/0x70
[    1.299387]  of_get_next_child+0x3c/0x60
[    1.303315]  simple_for_each_link+0x1dc/0x230
[    1.307676]  simple_probe+0x80/0x540
[    1.311256]  platform_drv_probe+0x50/0xa0

This patch is based on an earlier version posted by Kuninori Morimoto
and commit message includes explanations from Mark Brown.

https://patchwork.kernel.org/patch/10814255/

Reported-by: Vicente Bergas <vicencb@...il.com>
Signed-off-by: Daniel Baluta <daniel.baluta@....com>
---
 sound/soc/generic/simple-card.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
index 08df261024cf..dc18c4492955 100644
--- a/sound/soc/generic/simple-card.c
+++ b/sound/soc/generic/simple-card.c
@@ -445,7 +445,7 @@ static int simple_for_each_link(struct simple_priv *priv,
 	/* Check if it has dai-link */
 	node = of_get_child_by_name(top, PREFIX "dai-link");
 	if (!node) {
-		node = top;
+		node = of_node_get(top);
 		is_top = 1;
 	}
 
-- 
2.17.1