netdev - Re: [PATCH] net: mdiobus: fix an OF node reference leak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1e1c4c67-3e18-4364-9311-c9ba36a5e2b9@lunn.ch>
Date: Sun, 15 Dec 2024 12:03:32 +0100
From: Andrew Lunn <andrew@...n.ch>
To: Joe Hattori <joe@...is.s.u-tokyo.ac.jp>
Cc: hkallweit1@...il.com, linux@...linux.org.uk, davem@...emloft.net,
	edumazet@...gle.com, kuba@...nel.org, pabeni@...hat.com,
	netdev@...r.kernel.org
Subject: Re: [PATCH] net: mdiobus: fix an OF node reference leak

On Sat, Dec 14, 2024 at 05:15:46PM +0900, Joe Hattori wrote:
> fwnode_find_mii_timestamper() calls of_parse_phandle_with_fixed_args()
> but does not decrement the refcount of the obtained OF node. Add an
> of_node_put() call before returning from the function.
> 
> This bug was detected by an experimental static analysis tool that I am
> developing.
> 
> Fixes: bc1bee3b87ee ("net: mdiobus: Introduce fwnode_mdiobus_register_phy()")
> Signed-off-by: Joe Hattori <joe@...is.s.u-tokyo.ac.jp>
> ---
>  drivers/net/mdio/fwnode_mdio.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/mdio/fwnode_mdio.c b/drivers/net/mdio/fwnode_mdio.c
> index b156493d7084..83c8bd333117 100644
> --- a/drivers/net/mdio/fwnode_mdio.c
> +++ b/drivers/net/mdio/fwnode_mdio.c
> @@ -56,6 +56,7 @@ fwnode_find_mii_timestamper(struct fwnode_handle *fwnode)
>  	if (arg.args_count != 1)
>  		return ERR_PTR(-EINVAL);
>  
> +	of_node_put(arg.np);
>  	return register_mii_timestamper(arg.np, arg.args[0]);

This looks wrong to me. If you do a put on an object, it can
disappear, because it is not being used. You then pass it to
register_mii_timestamper() and it gets to use something which no
longer exists.

Please think about what get/put are used for, and what that means for
ordering.

Maybe you can extend your tool to look for potential use after free
bugs.

    Andrew

---
pw-bot: cr