linux-kernel - [PATCH v3 0/3] Fix i2c mux module refcount issues

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20231020153017.759926-1-herve.codina@bootlin.com>
Date:   Fri, 20 Oct 2023 17:30:10 +0200
From:   Herve Codina <herve.codina@...tlin.com>
To:     Wolfram Sang <wsa+renesas@...g-engineering.com>,
        Peter Rosin <peda@...ntia.se>,
        Stephen Warren <swarren@...dia.com>,
        Rob Herring <robh@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Jonathan Cameron <jic23@...nel.org>
Cc:     Wolfram Sang <wsa@...nel.org>, linux-i2c@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        Allan Nielsen <allan.nielsen@...rochip.com>,
        Horatiu Vultur <horatiu.vultur@...rochip.com>,
        Steen Hegelund <steen.hegelund@...rochip.com>,
        Thomas Petazzoni <thomas.petazzoni@...tlin.com>,
        Herve Codina <herve.codina@...tlin.com>
Subject: [PATCH v3 0/3] Fix i2c mux module refcount issues

Hi,

Some i2c mux drivers wrongly use the pair of_find_i2c_adapter_by_node()
/ i2c_put_adapter() to lock the parent adapter.

Indeed, i2c_put_adapter() decrements the module refcount while
of_find_i2c_adapter_by_node() does not increment it. This leads to an
overflow over zero of the parent adapter user counter.

Identified mux drivers impacted are:
- i2c-mux-gpmux
- i2c-demux-pinctrl
- i2c-mux-pinctrl

Commit 48e9743dd648 ("i2c: core: add and export of_get_i2c_adapter_by_node()
interface") introduces of_get_i2c_adapter_by_node() to correctly handle
this refcount issue.

This series fixes the 3 identified mux drivers replacing the
of_find_i2c_adapter_by_node() call by an of_get_i2c_adapter_by_node()
call.

Compare to the previous iteration
  https://lore.kernel.org/linux-kernel/20231019101017.425284-1-herve.codina@bootlin.com/
This v3 series:
 - Fixes a wrong <tab> char in a commit log message
 - Add 'Cc: stable@...r.kernel.org'
 - Add Reviewed-by tags

Best regards,
Hervé

Changes v2 -> v3
  - Patch 2
    Replace a wrong <tab> char by a <space> char in commit message

  - All patches
    Add 'Cc: stable@...r.kernel.org'
    Add 'Reviewed-by: Jonathan Cameron <Jonathan.Cameron@...wei.com>'

Changes v1 -> v2:
  - All patches
    Fix commit log
    Add relevant Fixes tag
    Add 'Acked-by: Peter Rosin <peda@...ntia.se>'

Herve Codina (3):
  i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node()
  i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node()
  i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node()

 drivers/i2c/muxes/i2c-demux-pinctrl.c | 2 +-
 drivers/i2c/muxes/i2c-mux-gpmux.c     | 2 +-
 drivers/i2c/muxes/i2c-mux-pinctrl.c   | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

-- 
2.41.0