From mboxrd@z Thu Jan 1 00:00:00 1970 From: Johan Hovold Subject: Re: [PATCH v2 0/9] of: fix compatible-child-node lookups Date: Tue, 4 Sep 2018 15:05:57 +0200 Message-ID: <20180904130557.GT28861@localhost> References: <20180827082153.22537-1-johan@kernel.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: <20180827082153.22537-1-johan@kernel.org> Sender: linux-kernel-owner@vger.kernel.org To: Rob Herring , Greg Kroah-Hartman Cc: Frank Rowand , devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , CK Hu , Philipp Zabel , Rob Clark , David Airlie , Ulf Hansson , Josh Wu , Boris Brezillon , Doug Berger , Florian Fainelli , "David S. Miller" , Giuseppe Cavallaro , Alexandre Torgue , Jose Abreu , Samuel Ortiz , Sebastian Reichel , Martin Blumenstingl List-Id: devicetree@vger.kernel.org Hi all, On Mon, Aug 27, 2018 at 10:21:44AM +0200, Johan Hovold wrote: > Several drivers currently use of_find_compatible_node() to lookup child > nodes while failing to notice that the of_find_ functions search the > entire tree depth-first (from a given start node) and therefore can > match unrelated nodes. > > The fact that these functions also drop a reference to the node they > start searching from (e.g. the parent node) is typically also > overlooked, something which can lead to use-after-free bugs (e.g. after > probe deferrals). > > This series adds a new helper, similar to of_get_child_by_name(), > that can be used to lookup compatible child nodes, and uses the new > helper to fix child-node lookups throughout the tree. > > This is related to the fixes I posted about a year ago, which addressed > a similar anti-pattern when looking up child nodes by name. Since it > took me more than a year to get all those fixes into Linus' tree (one > fix is still pending), and as these fixes depend on the new helper, I'm > suggesting that these all go in through Rob's or Greg's trees. > > Alternatively, the helper could go into to -rc2, and I'll be pinging > submaintainers for the coming year as well. ;) Rob has gotten the helper into -rc2 now: 36156f9241cb of: add helper to lookup compatible child node so feel free to pick these fixes up directly for 4.19-rc or -next, whichever you prefer. I've been able to trigger crashes after probe deferrals due to the use-after-free, but this seems unlikely to be exploitable. I think Rob will be picking up any patches that remain by the end of the release cycle for 4.20. Thanks, Johan > Johan Hovold (9): > of: add helper to lookup compatible child node > drm/mediatek: fix OF sibling-node lookup > drm/msm: fix OF child-node lookup > mmc: meson-mx-sdio: fix OF child-node lookup > mtd: nand: atmel: fix OF child-node lookup > net: bcmgenet: fix OF child-node lookup > net: stmmac: dwmac-sun8i: fix OF child-node lookup > NFC: nfcmrvl_uart: fix OF child-node lookup > power: supply: twl4030-charger: fix OF sibling-node lookup > > drivers/gpu/drm/mediatek/mtk_hdmi.c | 5 ++-- > drivers/gpu/drm/msm/adreno/adreno_gpu.c | 5 ++-- > drivers/mmc/host/meson-mx-sdio.c | 8 ++++-- > drivers/mtd/nand/raw/atmel/nand-controller.c | 11 +++++--- > drivers/net/ethernet/broadcom/genet/bcmmii.c | 2 +- > .../net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 12 +++++++-- > drivers/nfc/nfcmrvl/uart.c | 5 ++-- > drivers/of/base.c | 25 +++++++++++++++++++ > drivers/power/supply/twl4030_charger.c | 5 ++-- > include/linux/of.h | 8 ++++++ > 10 files changed, 68 insertions(+), 18 deletions(-)