lkml.org 
[lkml]   [2022]   [Oct]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 6.0 461/862] iio: inkern: only release the device node when done with it
    Date
    From: Nuno Sá <nuno.sa@analog.com>

    [ Upstream commit 79c3e84874c7d14f04ad58313b64955a0d2e9437 ]

    'of_node_put()' can potentially release the memory pointed to by
    'iiospec.np' which would leave us with an invalid pointer (and we would
    still pass it in 'of_xlate()'). Note that it is not guaranteed for the
    of_node lifespan to be attached to the device (to which is attached)
    lifespan so that there is (even though very unlikely) the possibility
    for the node to be freed while the device is still around. Thus, as there
    are indeed some of_xlate users which do access the node, a race is indeed
    possible.

    As such, we can only release the node after we are done with it.

    Fixes: 17d82b47a215d ("iio: Add OF support")
    Signed-off-by: Nuno Sá <nuno.sa@analog.com>
    Link: https://lore.kernel.org/r/20220715122903.332535-2-nuno.sa@analog.com
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/iio/inkern.c | 6 ++++--
    1 file changed, 4 insertions(+), 2 deletions(-)

    diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
    index df74765d33dc..9d87057794fc 100644
    --- a/drivers/iio/inkern.c
    +++ b/drivers/iio/inkern.c
    @@ -165,9 +165,10 @@ static int __of_iio_channel_get(struct iio_channel *channel,

    idev = bus_find_device(&iio_bus_type, NULL, iiospec.np,
    iio_dev_node_match);
    - of_node_put(iiospec.np);
    - if (idev == NULL)
    + if (idev == NULL) {
    + of_node_put(iiospec.np);
    return -EPROBE_DEFER;
    + }

    indio_dev = dev_to_iio_dev(idev);
    channel->indio_dev = indio_dev;
    @@ -175,6 +176,7 @@ static int __of_iio_channel_get(struct iio_channel *channel,
    index = indio_dev->info->of_xlate(indio_dev, &iiospec);
    else
    index = __of_iio_simple_xlate(indio_dev, &iiospec);
    + of_node_put(iiospec.np);
    if (index < 0)
    goto err_put;
    channel->channel = &indio_dev->channels[index];
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-10-19 12:50    [W:4.584 / U:0.084 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site