netdev - Re: [PATCH net v3] net: mdiobus: fix double put fwnode in the error path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 3 Dec 2022 10:14:43 +0800
From:   Zeng Heng <zengheng4@...wei.com>
To:     Yang Yingliang <yangyingliang@...wei.com>, <netdev@...r.kernel.org>
CC:     <andrew@...n.ch>, <hkallweit1@...il.com>, <linux@...linux.org.uk>,
        <davem@...emloft.net>, <edumazet@...gle.com>, <kuba@...nel.org>,
        <pabeni@...hat.com>, <ioana.ciornei@....com>,
        <calvin.johnson@....nxp.com>, <grant.likely@....com>
Subject: Re: [PATCH net v3] net: mdiobus: fix double put fwnode in the error
 path


On 2022/12/2 13:18, Yang Yingliang wrote:
> If phy_device_register() or fwnode_mdiobus_phy_device_register()
> fail, phy_device_free() is called, the device refcount is decreased
> to 0, then fwnode_handle_put() will be called in phy_device_release(),
> but in the error path, fwnode_handle_put() has already been called,
> so set fwnode to NULL after fwnode_handle_put() in the error path to
> avoid double put.
>
> Fixes: cdde1560118f ("net: mdiobus: fix unbalanced node reference count")
> Reported-by: Zeng Heng <zengheng4@...wei.com>
> Tested-by: Zeng Heng <zengheng4@...wei.com>
> Signed-off-by: Yang Yingliang <yangyingliang@...wei.com>
> ---
> v2 -> v3:
>    set fwnode to NULL before calling fwnode_handle_put()
>
> v1 -> v2:
>    Don't remove fwnode_handle_put() in the error path,
>    set fwnode to NULL avoid double put.
> ---
>   drivers/net/mdio/fwnode_mdio.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/mdio/fwnode_mdio.c b/drivers/net/mdio/fwnode_mdio.c
> index eb344f6d4a7b..b782c35c4ac1 100644
> --- a/drivers/net/mdio/fwnode_mdio.c
> +++ b/drivers/net/mdio/fwnode_mdio.c
> @@ -98,6 +98,7 @@ int fwnode_mdiobus_phy_device_register(struct mii_bus *mdio,
>   	 */
>   	rc = phy_device_register(phy);
>   	if (rc) {
> +		device_set_node(&phy->mdio.dev, NULL);
>   		fwnode_handle_put(child);
>   		return rc;
>   	}
> @@ -153,7 +154,8 @@ int fwnode_mdiobus_register_phy(struct mii_bus *bus,
>   		/* All data is now stored in the phy struct, so register it */
>   		rc = phy_device_register(phy);
>   		if (rc) {
> -			fwnode_handle_put(phy->mdio.dev.fwnode);
> +			phy->mdio.dev.fwnode = NULL;
> +			fwnode_handle_put(child);
>   			goto clean_phy;
>   		}
>   	} else if (is_of_node(child)) {

Reviewed-by: Zeng Heng <zengheng4@...wei.com>

Tested-by: Zeng Heng <zengheng4@...wei.com>