[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20221102110102.25050-2-luca.ceresoli@bootlin.com>
Date: Wed, 2 Nov 2022 12:01:02 +0100
From: luca.ceresoli@...tlin.com
To: Thierry Reding <thierry.reding@...il.com>,
Jonathan Hunter <jonathanh@...dia.com>,
Sowjanya Komatineni <skomatineni@...dia.com>,
Mauro Carvalho Chehab <mchehab@...nel.org>,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
Hans Verkuil <hverkuil-cisco@...all.nl>,
Dmitry Osipenko <digetx@...il.com>
Cc: Mauro Carvalho Chehab <mchehab+huawei@...nel.org>,
linux-media@...r.kernel.org, linux-tegra@...r.kernel.org,
linux-staging@...ts.linux.dev, linux-kernel@...r.kernel.org,
Luca Ceresoli <luca.ceresoli@...tlin.com>,
stable@...r.kernel.org
Subject: [PATCH v2 2/2] staging: media: tegra-video: fix device_node use after free
From: Luca Ceresoli <luca.ceresoli@...tlin.com>
At probe time this code path is followed:
* tegra_csi_init
* tegra_csi_channels_alloc
* for_each_child_of_node(node, channel) -- iterates over channels
* automatically gets 'channel'
* tegra_csi_channel_alloc()
* saves into chan->of_node a pointer to the channel OF node
* automatically gets and puts 'channel'
* now the node saved in chan->of_node has refcount 0, can disappear
* tegra_csi_channels_init
* iterates over channels
* tegra_csi_channel_init -- uses chan->of_node
After that, chan->of_node keeps storing the node until the device is
removed.
of_node_get() the node and of_node_put() it during teardown to avoid any
risk.
Fixes: 1ebaeb09830f ("media: tegra-video: Add support for external sensor capture")
Cc: stable@...r.kernel.org
Cc: Sowjanya Komatineni <skomatineni@...dia.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@...tlin.com>
---
No changes in v2.
---
drivers/staging/media/tegra-video/csi.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/media/tegra-video/csi.c b/drivers/staging/media/tegra-video/csi.c
index 6b59ef55c525..426e653bd55d 100644
--- a/drivers/staging/media/tegra-video/csi.c
+++ b/drivers/staging/media/tegra-video/csi.c
@@ -433,7 +433,7 @@ static int tegra_csi_channel_alloc(struct tegra_csi *csi,
for (i = 0; i < chan->numgangports; i++)
chan->csi_port_nums[i] = port_num + i * CSI_PORTS_PER_BRICK;
- chan->of_node = node;
+ chan->of_node = of_node_get(node);
chan->numpads = num_pads;
if (num_pads & 0x2) {
chan->pads[0].flags = MEDIA_PAD_FL_SINK;
@@ -641,6 +641,7 @@ static void tegra_csi_channels_cleanup(struct tegra_csi *csi)
media_entity_cleanup(&subdev->entity);
}
+ of_node_put(chan->of_node);
list_del(&chan->list);
kfree(chan);
}
--
2.34.1
Powered by blists - more mailing lists