Re: [PATCH] mtd: rawnand: tegra: fix OF node leak in tegra_nand_chips_init() - sashiko-bot

From: sashiko-bot@kernel.org
To: "Thierry Reding" <thierry.reding@kernel.org>,
	"Vignesh Raghavendra" <vigneshr@ti.com>,
	"Haotian Zhang" <vulab@iscas.ac.cn>,
	"Richard Weinberger" <richard@nod.at>,
	"Stefan Agner" <stefan@agner.ch>,
	"Miquel Raynal" <miquel.raynal@bootlin.com>,
	"Lucas Stach" <dev@lynxeye.de>,
	"Jonathan Hunter" <jonathanh@nvidia.com>,
	"Dmitry Osipenko" <digetx@gmail.com>,
	"Boris Brezillon" <bbrezillon@kernel.org>
Cc: linux-tegra@vger.kernel.org, linux-mtd@lists.infradead.org,
	linux-kernel@vger.kernel.org
Subject: Re: [PATCH] mtd: rawnand: tegra: fix OF node leak in tegra_nand_chips_init()
Date: Thu, 08 Oct 2026 18:34:19 +0000	[thread overview]
Message-ID: <sashiko-outbox-164461@kernel.org> (raw)
In-Reply-To: <20261008182442.2770036-1-vulab@iscas.ac.cn>

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] mtd: rawnand: tegra: UAF due to premature of_node_put() before registration
--

commit 1cf3654f6b317262348cbad1bbf461282840058e
Author: Haotian Zhang <vulab@iscas.ac.cn>

mtd: rawnand: tegra: fix OF node leak in tegra_nand_chips_init()

This commit attempts to fix a device node leak by releasing np_nand right
after calling nand_set_flash_node().

> diff --git a/drivers/mtd/nand/raw/tegra_nand.c b/drivers/mtd/nand/raw/tegra_nand.c
> --- a/drivers/mtd/nand/raw/tegra_nand.c
> +++ b/drivers/mtd/nand/raw/tegra_nand.c
[ ... ]
> @@ -1119,6 +1122,7 @@ static int tegra_nand_chips_init(struct device *dev,
>  	mtd->owner = THIS_MODULE;
>  
>  	nand_set_flash_node(chip, np_nand);
> +	of_node_put(np_nand);

[Severity: High]
Does this introduce a use-after-free risk for the device node?

The nand_set_flash_node() helper stores the pointer in mtd->dev.of_node
but does not increment its reference count. By dropping the reference here,
could the node be freed before subsequent accesses?

Later in this function, nand_scan() dereferences this flash node to read 
properties:

drivers/mtd/nand/raw/nand_base.c:of_get_nand_bus_width() {
    struct device_node *dn = nand_get_flash_node(chip);
    ...
    ret = of_property_read_u32(dn, "nand-bus-width", &val);
    ...
}

Furthermore, mtd_device_register() will also access the node to increment
its refcount:

drivers/mtd/mtdcore.c:add_mtd_device() {
    ...
    mtd_check_of_node(mtd);
    of_node_get(mtd_get_of_node(mtd));
    ...
}

If dynamic DT unloading drops the final reference before
mtd_device_register() completes, it appears these later calls might access
freed memory.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261008182442.2770036-1-vulab@iscas.ac.cn?part=1

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/