| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <04a8bbc4-ab17-4937-8840-893b17114335@solid-run.com>
Date: Wed, 21 Jan 2026 09:00:09 +0000
From: Josua Mayer <josua@...id-run.com>
To: Geert Uytterhoeven <geert@...ux-m68k.org>
CC: Marc Kleine-Budde <mkl@...gutronix.de>, Vincent Mailhol
<mailhol@...nel.org>, Vinod Koul <vkoul@...nel.org>, Neil Armstrong
<neil.armstrong@...aro.org>, Peter Rosin <peda@...ntia.se>, Aaro Koskinen
<aaro.koskinen@....fi>, Andreas Kemnade <andreas@...nade.info>, Kevin Hilman
<khilman@...libre.com>, Roger Quadros <rogerq@...nel.org>, Tony Lindgren
<tony@...mide.com>, Janusz Krzysztofik <jmkrzyszt@...il.com>, Vignesh R
<vigneshr@...com>, Andi Shyti <andi.shyti@...nel.org>, Ulf Hansson
<ulf.hansson@...aro.org>, Rob Herring <robh@...nel.org>, Krzysztof Kozlowski
<krzk+dt@...nel.org>, Conor Dooley <conor+dt@...nel.org>, Geert Uytterhoeven
<geert+renesas@...der.be>, Magnus Damm <magnus.damm@...il.com>, Wolfram Sang
<wsa+renesas@...g-engineering.com>, Yazan Shhady
<yazan.shhady@...id-run.com>, Jon Nettleton <jon@...id-run.com>, Mikhail
Anikin <mikhail.anikin@...id-run.com>, "linux-can@...r.kernel.org"
<linux-can@...r.kernel.org>, "linux-phy@...ts.infradead.org"
<linux-phy@...ts.infradead.org>, "linux-kernel@...r.kernel.org"
<linux-kernel@...r.kernel.org>, "linux-omap@...r.kernel.org"
<linux-omap@...r.kernel.org>, "linux-i2c@...r.kernel.org"
<linux-i2c@...r.kernel.org>, "linux-mmc@...r.kernel.org"
<linux-mmc@...r.kernel.org>, "devicetree@...r.kernel.org"
<devicetree@...r.kernel.org>, "linux-renesas-soc@...r.kernel.org"
<linux-renesas-soc@...r.kernel.org>
Subject: Re: [PATCH v5 2/7] mux: Add helper functions for getting optional and
selected mux-state
On 20/01/2026 11:45, Geert Uytterhoeven wrote:
> Hi Josua,
>
> On Sun, 18 Jan 2026 at 11:29, Josua Mayer <josua@...id-run.com> wrote:
>> In-tree phy-can-transceiver driver has already implemented a local
>> version of devm_mux_state_get_optional.
>>
>> The omap-i2c driver gets and selects an optional mux in its probe
>> function without using any helper.
>>
>> Add new helper functions covering both aforementioned use-cases:
>>
>> - mux_control_get_optional:
>> Get a mux-control if specified in dt, return NULL otherwise.
>> - devm_mux_state_get_optional:
>> Get a mux-state if specified in dt, return NULL otherwise.
>> - devm_mux_state_get_selected:
>> Get and select a mux-state specified in dt, return error otherwise.
>> - devm_mux_state_get_optional_selected:
>> Get and select a mux-state if specified in dt, return error or NULL.
>>
>> Existing mux_get helper function is changed to take an extra argument
>> indicating whether the mux is optional.
>> In this case no error is printed, and NULL returned in case of ENOENT.
>>
>> Calling code is adapted to handle NULL return case, and to pass optional
>> argument as required.
>>
>> To support automatic deselect for _selected helper, a new structure is
>> created storing an exit pointer similar to clock core which is called on
>> release.
>>
>> To facilitate code sharing between optional/mandatory/selected helpers,
>> a new internal helper function is added to handle quiet (optional) and
>> verbose (mandatory) errors, as well as storing the correct callback for
>> devm release: __devm_mux_state_get
>>
>> Due to this structure devm_mux_state_get_*_selected can no longer print
>> a useful error message when select fails. Instead callers should print
>> errors where needed.
>>
>> Commit e153fdea9db04 ("phy: can-transceiver: Re-instate "mux-states"
>> property presence check") noted that "mux_get() always prints an error
>> message in case of an error, including when the property is not present,
>> confusing the user."
>>
>> The first error message covers the case that a mux name is not matched
>> in dt. The second error message is based on of_parse_phandle_with_args
>> return value.
>>
>> In optional case no error is printed and NULL is returned.
>> This ensures that the new helper functions will not confuse the user
>> either.
>>
>> With the addition of optional helper functions it became clear that
>> drivers should compile and link even if CONFIG_MULTIPLEXER was not enabled.
>> Add stubs for all symbols exported by mux core.
>>
>> Signed-off-by: Josua Mayer <josua@...id-run.com>
> Thanks for your patch!
>
>> --- a/drivers/mux/core.c
>> +++ b/drivers/mux/core.c
>> @@ -677,7 +707,7 @@ EXPORT_SYMBOL_GPL(devm_mux_control_get);
>> *
>> * Return: A pointer to the mux-state, or an ERR_PTR with a negative errno.
>> */
>> -static struct mux_state *mux_state_get(struct device *dev, const char *mux_name)
>> +static struct mux_state *mux_state_get(struct device *dev, const char *mux_name, bool optional)
>> {
>> struct mux_state *mstate;
>>
>> @@ -685,12 +715,10 @@ static struct mux_state *mux_state_get(struct device *dev, const char *mux_name)
>> if (!mstate)
>> return ERR_PTR(-ENOMEM);
>>
>> - mstate->mux = mux_get(dev, mux_name, &mstate->state);
>> - if (IS_ERR(mstate->mux)) {
>> - int err = PTR_ERR(mstate->mux);
>> -
>> + mstate->mux = mux_get(dev, mux_name, &mstate->state, optional);
>> + if (IS_ERR_OR_NULL(mstate->mux)) {
>> kfree(mstate);
> mstate is freed here...
>
>> - return ERR_PTR(err);
>> + return ERR_CAST(mstate->mux);
> ... and dereferenced here, leading to a use after free.
Thank you for spotting this, I will resolve it in next version!
(along with what the kernel robot found)
>
>> }
>>
>> return mstate;
> Gr{oetje,eeting}s,
>
> Geert
>
Powered by blists - more mailing lists