netdev - Re: [PATCH net v2] net: mdiobus: fix double put fwnode in the error path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 2 Dec 2022 09:38:08 +0800
From:   Yang Yingliang <yangyingliang@...wei.com>
To:     Andrew Lunn <andrew@...n.ch>
CC:     <netdev@...r.kernel.org>, <hkallweit1@...il.com>,
        <linux@...linux.org.uk>, <davem@...emloft.net>,
        <edumazet@...gle.com>, <kuba@...nel.org>, <pabeni@...hat.com>,
        <ioana.ciornei@....com>, <calvin.johnson@....nxp.com>,
        <grant.likely@....com>, <zengheng4@...wei.com>
Subject: Re: [PATCH net v2] net: mdiobus: fix double put fwnode in the error
 path


On 2022/12/1 23:33, Andrew Lunn wrote:
> On Thu, Dec 01, 2022 at 11:38:38AM +0800, Yang Yingliang wrote:
>> If phy_device_register() or fwnode_mdiobus_phy_device_register()
>> fail, phy_device_free() is called, the device refcount is decreased
>> to 0, then fwnode_handle_put() will be called in phy_device_release(),
>> but in the error path, fwnode_handle_put() has already been called,
>> so set fwnode to NULL after fwnode_handle_put() in the error path to
>> avoid double put.
>>
>> Fixes: cdde1560118f ("net: mdiobus: fix unbalanced node reference count")
>> Reported-by: Zeng Heng <zengheng4@...wei.com>
>> Tested-by: Zeng Heng <zengheng4@...wei.com>
>> Signed-off-by: Yang Yingliang <yangyingliang@...wei.com>
>> ---
>> v1 -> v2:
>>    Don't remove fwnode_handle_put() in the error path,
>>    set fwnode to NULL avoid double put.
>> ---
>>   drivers/net/mdio/fwnode_mdio.c | 2 ++
>>   1 file changed, 2 insertions(+)
>>
>> diff --git a/drivers/net/mdio/fwnode_mdio.c b/drivers/net/mdio/fwnode_mdio.c
>> index eb344f6d4a7b..9df618577712 100644
>> --- a/drivers/net/mdio/fwnode_mdio.c
>> +++ b/drivers/net/mdio/fwnode_mdio.c
>> @@ -99,6 +99,7 @@ int fwnode_mdiobus_phy_device_register(struct mii_bus *mdio,
>>   	rc = phy_device_register(phy);
>>   	if (rc) {
>>   		fwnode_handle_put(child);
>> +		device_set_node(&phy->mdio.dev, NULL);
>>   		return rc;
>>   	}
> This looks better, it is balanced. But i would argue the order is
> wrong.
>
> 	fwnode_handle_get(child);
> 	device_set_node(&phy->mdio.dev, child);
>
> 	/* All data is now stored in the phy struct;
> 	 * register it
> 	 */
> 	rc = phy_device_register(phy);
> 	if (rc) {
> 		fwnode_handle_put(child);
> 		return rc;
> 	}
>
> In general you undo stuff in the opposite order to which you did
> it. So device_set_node() first, then fwnode_handle_put(). Otherwise
> you have a potential race condition.
OK, I will change the order in v3.

Thanks,
Yang
>
>      Andrew
> .