From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Andy Shevchenko <andriy.shevchenko@linux.intel.com>,
"Rafael J . Wysocki" <rafael.j.wysocki@intel.com>,
Sakari Ailus <sakari.ailus@linux.intel.com>,
Heikki Krogerus <heikki.krogerus@linux.intel.com>,
Daniel Scally <djrscally@gmail.com>
Cc: linux-acpi@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH 1/2] device property: do not leak child nodes when using NULL/error pointers
Date: Wed, 27 Nov 2024 21:39:34 -0800 [thread overview]
Message-ID: <20241128053937.4076797-1-dmitry.torokhov@gmail.com> (raw)
The documentation to various API calls that locate children for a given
fwnode (such as fwnode_get_next_available_child_node() or
device_get_next_child_node()) states that the reference to the node
passed in "child" argument is dropped unconditionally, however the
change that added checks for the main node to be NULL or error pointer
broke this promise.
Add missing fwnode_handle_put() calls to restore the documented
behavior.
Fixes: 002752af7b89 ("device property: Allow error pointer to be passed to fwnode APIs")
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
drivers/base/property.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/base/property.c b/drivers/base/property.c
index 837d77e3af2b..696ba43b8e8a 100644
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -759,6 +759,12 @@ struct fwnode_handle *
fwnode_get_next_child_node(const struct fwnode_handle *fwnode,
struct fwnode_handle *child)
{
+ if (IS_ERR_OR_NULL(fwnode) ||
+ !fwnode_has_op(fwnode, get_next_child_node)) {
+ fwnode_handle_put(child);
+ return NULL;
+ }
+
return fwnode_call_ptr_op(fwnode, get_next_child_node, child);
}
EXPORT_SYMBOL_GPL(fwnode_get_next_child_node);
@@ -778,9 +784,6 @@ fwnode_get_next_available_child_node(const struct fwnode_handle *fwnode,
{
struct fwnode_handle *next_child = child;
- if (IS_ERR_OR_NULL(fwnode))
- return NULL;
-
do {
next_child = fwnode_get_next_child_node(fwnode, next_child);
if (!next_child)
@@ -806,8 +809,10 @@ struct fwnode_handle *device_get_next_child_node(const struct device *dev,
const struct fwnode_handle *fwnode = dev_fwnode(dev);
struct fwnode_handle *next;
- if (IS_ERR_OR_NULL(fwnode))
+ if (IS_ERR_OR_NULL(fwnode)) {
+ fwnode_handle_put(child);
return NULL;
+ }
/* Try to find a child in primary fwnode */
next = fwnode_get_next_child_node(fwnode, child);
--
2.47.0.338.g60cca15819-goog
next reply other threads:[~2024-11-28 5:39 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-11-28 5:39 Dmitry Torokhov [this message]
2024-11-28 5:39 ` [PATCH 2/2] device property: fix UAF in device_get_next_child_node() Dmitry Torokhov
2024-11-28 13:20 ` Andy Shevchenko
2024-11-28 23:16 ` Dmitry Torokhov
2024-12-09 18:11 ` Andy Shevchenko
2024-11-28 11:49 ` [PATCH 1/2] device property: do not leak child nodes when using NULL/error pointers Greg Kroah-Hartman
2024-11-28 13:13 ` Andy Shevchenko
2024-11-28 23:04 ` Dmitry Torokhov
2024-11-29 14:50 ` Andy Shevchenko
2024-11-30 7:16 ` Dmitry Torokhov
2024-11-30 21:44 ` Andy Shevchenko
2024-12-03 5:49 ` Dmitry Torokhov
2024-12-03 13:27 ` Andy Shevchenko
2024-12-03 22:45 ` Dmitry Torokhov
2024-12-04 1:16 ` Andy Shevchenko
2024-12-05 20:57 ` Dmitry Torokhov
2024-12-09 18:06 ` Andy Shevchenko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20241128053937.4076797-1-dmitry.torokhov@gmail.com \
--to=dmitry.torokhov@gmail.com \
--cc=andriy.shevchenko@linux.intel.com \
--cc=djrscally@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=heikki.krogerus@linux.intel.com \
--cc=linux-acpi@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=rafael.j.wysocki@intel.com \
--cc=sakari.ailus@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox