linux-kernel - Re: [PATCH] staging: media: tegra-video: fix device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 28 Oct 2022 15:34:39 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     luca.ceresoli@...tlin.com
Cc:     Thierry Reding <thierry.reding@...il.com>,
        Jonathan Hunter <jonathanh@...dia.com>,
        Sowjanya Komatineni <skomatineni@...dia.com>,
        Mauro Carvalho Chehab <mchehab@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Hans Verkuil <hverkuil-cisco@...all.nl>,
        Thomas Petazzoni <thomas.petazzoni@...tlin.com>,
        stable@...r.kernel.org,
        Mauro Carvalho Chehab <mchehab+huawei@...nel.org>,
        linux-media@...r.kernel.org, linux-tegra@...r.kernel.org,
        linux-staging@...ts.linux.dev, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] staging: media: tegra-video: fix device_node use after
 free

On Fri, Oct 28, 2022 at 10:19:26AM +0200, luca.ceresoli@...tlin.com wrote:
> From: Luca Ceresoli <luca.ceresoli@...tlin.com>
> 
> At probe time this code path is followed:
> 
>  * tegra_csi_init
>    * tegra_csi_channels_alloc
>      * for_each_child_of_node(node, channel) -- iterates over channels
>        * automatically gets 'channel'
>          * tegra_csi_channel_alloc()
>            * saves into chan->of_node a pointer to the channel OF node
>        * automatically gets and puts 'channel'
>        * now the node saved in chan->of_node has refcount 0, can disappear
>    * tegra_csi_channels_init
>      * iterates over channels
>        * tegra_csi_channel_init -- uses chan->of_node
> 
> After that, chan->of_node keeps storing the node until the device is
> removed.
> 
> of_node_get() the node and of_node_put() it during teardown to avoid any
> risk.
> 
> Fixes: 1ebaeb09830f ("media: tegra-video: Add support for external sensor capture")
> Cc: stable@...r.kernel.org
> Cc: Sowjanya Komatineni <skomatineni@...dia.com>
> Signed-off-by: Luca Ceresoli <luca.ceresoli@...tlin.com>
> ---
>  drivers/staging/media/tegra-video/csi.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/staging/media/tegra-video/csi.c b/drivers/staging/media/tegra-video/csi.c
> index b26e44adb2be..1b05f620b476 100644
> --- a/drivers/staging/media/tegra-video/csi.c
> +++ b/drivers/staging/media/tegra-video/csi.c
> @@ -433,7 +433,7 @@ static int tegra_csi_channel_alloc(struct tegra_csi *csi,
>  	for (i = 0; i < chan->numgangports; i++)
>  		chan->csi_port_nums[i] = port_num + i * CSI_PORTS_PER_BRICK;
>  
> -	chan->of_node = node;
> +	chan->of_node = of_node_get(node);
>  	chan->numpads = num_pads;
>  	if (num_pads & 0x2) {
>  		chan->pads[0].flags = MEDIA_PAD_FL_SINK;
> @@ -640,6 +640,7 @@ static void tegra_csi_channels_cleanup(struct tegra_csi *csi)
>  			media_entity_cleanup(&subdev->entity);
>  		}
>  
> +		of_node_put(chan->of_node);
>  		list_del(&chan->list);
>  		kfree(chan);

Not related to your patch, but this kind of "one function cleans up
everything" style is always buggy.  For example, here it should be:

-		if (chan->mipi)
+		if (!IS_ERR_OR_NULL(chan->mipi))
			tegra_mipi_free(chan->mipi);

regards,
dan carpenter