From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 13E67CDB474 for ; Mon, 23 Oct 2023 10:59:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232700AbjJWK76 (ORCPT ); Mon, 23 Oct 2023 06:59:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37114 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232598AbjJWK75 (ORCPT ); Mon, 23 Oct 2023 06:59:57 -0400 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1B34CD7C for ; Mon, 23 Oct 2023 03:59:55 -0700 (PDT) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5B664C433C7; Mon, 23 Oct 2023 10:59:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1698058794; bh=pOLasdNMux+4XHSRksmR78OJOlktqf7lYtswJyA3kCE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sMUo83aKoDwNQhh5fpRAPS14Z3JhDHAgM8YISTyytG437+r0I1e3H6VcZvRH3qZmn 4RQiHaT1mGePYNvsLYVnNXTkC6Gkq32dxy15QNxZBe7mWDgsjAct2qHu+uWoHDlEOw YjSRfvayKfbjS80Dql7gQXixq8E9jOw5EqzKm0H4= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Dmitry Torokhov , Linus Walleij Subject: [PATCH 4.14 21/66] pinctrl: avoid unsafe code pattern in find_pinctrl() Date: Mon, 23 Oct 2023 12:56:11 +0200 Message-ID: <20231023104811.597923768@linuxfoundation.org> X-Mailer: git-send-email 2.42.0 In-Reply-To: <20231023104810.781270702@linuxfoundation.org> References: <20231023104810.781270702@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dmitry Torokhov commit c153a4edff6ab01370fcac8e46f9c89cca1060c2 upstream. The code in find_pinctrl() takes a mutex and traverses a list of pinctrl structures. Later the caller bumps up reference count on the found structure. Such pattern is not safe as pinctrl that was found may get deleted before the caller gets around to increasing the reference count. Fix this by taking the reference count in find_pinctrl(), while it still holds the mutex. Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov Link: https://lore.kernel.org/r/ZQs1RgTKg6VJqmPs@google.com Signed-off-by: Linus Walleij Signed-off-by: Greg Kroah-Hartman --- drivers/pinctrl/core.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) --- a/drivers/pinctrl/core.c +++ b/drivers/pinctrl/core.c @@ -973,17 +973,20 @@ static int add_setting(struct pinctrl *p static struct pinctrl *find_pinctrl(struct device *dev) { - struct pinctrl *p; + struct pinctrl *entry, *p = NULL; mutex_lock(&pinctrl_list_mutex); - list_for_each_entry(p, &pinctrl_list, node) - if (p->dev == dev) { - mutex_unlock(&pinctrl_list_mutex); - return p; + + list_for_each_entry(entry, &pinctrl_list, node) { + if (entry->dev == dev) { + p = entry; + kref_get(&p->users); + break; } + } mutex_unlock(&pinctrl_list_mutex); - return NULL; + return p; } static void pinctrl_free(struct pinctrl *p, bool inlist); @@ -1092,7 +1095,6 @@ struct pinctrl *pinctrl_get(struct devic p = find_pinctrl(dev); if (p) { dev_dbg(dev, "obtain a copy of previously claimed pinctrl\n"); - kref_get(&p->users); return p; }