* FAILED: patch "[PATCH] media: microchip-isc: take a reference on the parsed" failed to apply to 5.15-stable tree
@ 2026-11-04 14:17 gregkh
2026-11-05 0:16 ` [PATCH 5.15.y] media: microchip-isc: take a reference on the parsed endpoints Sasha Levin
0 siblings, 1 reply; 2+ messages in thread
From: gregkh @ 2026-11-04 14:17 UTC (permalink / raw)
To: balakrishnan.s, ehristev, hverkuil+cisco; +Cc: stable
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x f2eb2fd388bf3f1959556a326e797cacca341c86
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026110457-mummy-online-37cb@gregkh' --subject-prefix 'PATCH 5.15.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From f2eb2fd388bf3f1959556a326e797cacca341c86 Mon Sep 17 00:00:00 2001
From: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Date: Mon, 17 Aug 2026 12:21:59 +0530
Subject: [PATCH] media: microchip-isc: take a reference on the parsed
endpoints
for_each_endpoint_of_node() drops the reference on the current node as
it advances. xisc_parse_dt() and isc_parse_dt() store the node in
subdev_entity->epn and release it later with of_node_put(), but never
took their own reference, so the stored pointer refers to an
already-released node. This underflows the refcount and can
use-after-free, reachable through the camera device tree overlay.
Take a reference with of_node_get() when storing the node, and drop it
in microchip_isc_subdev_cleanup() so the entities the bind loop never
reaches on an early exit do not leak it.
Fixes: c9aa973884a1 ("media: atmel: atmel-isc: add microchip-xisc driver")
Fixes: d6701f13bd07 ("media: atmel: Use v4l2_async_notifier_add_fwnode_remote_subdev")
Cc: stable@vger.kernel.org
Signed-off-by: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
diff --git a/drivers/media/platform/microchip/microchip-isc-base.c b/drivers/media/platform/microchip/microchip-isc-base.c
index eebbcb28a7ee..ca4f3b5f58aa 100644
--- a/drivers/media/platform/microchip/microchip-isc-base.c
+++ b/drivers/media/platform/microchip/microchip-isc-base.c
@@ -1853,6 +1853,12 @@ void microchip_isc_subdev_cleanup(struct isc_device *isc)
list_for_each_entry(subdev_entity, &isc->subdev_entities, list) {
v4l2_async_nf_unregister(&subdev_entity->notifier);
v4l2_async_nf_cleanup(&subdev_entity->notifier);
+ /*
+ * Release the endpoint reference taken while parsing. It is
+ * NULL for entities the bind loop already consumed, so this
+ * only drops the ones left over on an early exit.
+ */
+ of_node_put(subdev_entity->epn);
}
INIT_LIST_HEAD(&isc->subdev_entities);
diff --git a/drivers/media/platform/microchip/microchip-sama5d2-isc.c b/drivers/media/platform/microchip/microchip-sama5d2-isc.c
index 25d241b4c66a..18e1ec0b94fa 100644
--- a/drivers/media/platform/microchip/microchip-sama5d2-isc.c
+++ b/drivers/media/platform/microchip/microchip-sama5d2-isc.c
@@ -357,28 +357,30 @@ static int isc_parse_dt(struct device *dev, struct isc_device *isc)
struct device_node *epn;
struct isc_subdev_entity *subdev_entity;
unsigned int flags;
+ int ret;
INIT_LIST_HEAD(&isc->subdev_entities);
for_each_endpoint_of_node(np, epn) {
struct v4l2_fwnode_endpoint v4l2_epn = { .bus_type = 0 };
- int ret;
ret = v4l2_fwnode_endpoint_parse(of_fwnode_handle(epn),
&v4l2_epn);
if (ret) {
- of_node_put(epn);
dev_err(dev, "Could not parse the endpoint\n");
- return -EINVAL;
+ of_node_put(epn);
+ ret = -EINVAL;
+ goto err_cleanup;
}
subdev_entity = devm_kzalloc(dev, sizeof(*subdev_entity),
GFP_KERNEL);
if (!subdev_entity) {
of_node_put(epn);
- return -ENOMEM;
+ ret = -ENOMEM;
+ goto err_cleanup;
}
- subdev_entity->epn = epn;
+ subdev_entity->epn = of_node_get(epn);
flags = v4l2_epn.bus.parallel.flags;
@@ -399,6 +401,11 @@ static int isc_parse_dt(struct device *dev, struct isc_device *isc)
}
return 0;
+
+err_cleanup:
+ list_for_each_entry(subdev_entity, &isc->subdev_entities, list)
+ of_node_put(subdev_entity->epn);
+ return ret;
}
static int microchip_isc_probe(struct platform_device *pdev)
diff --git a/drivers/media/platform/microchip/microchip-sama7g5-isc.c b/drivers/media/platform/microchip/microchip-sama7g5-isc.c
index 28d975002476..07cfe1109ff0 100644
--- a/drivers/media/platform/microchip/microchip-sama7g5-isc.c
+++ b/drivers/media/platform/microchip/microchip-sama7g5-isc.c
@@ -341,6 +341,7 @@ static int xisc_parse_dt(struct device *dev, struct isc_device *isc)
struct isc_subdev_entity *subdev_entity;
unsigned int flags;
bool mipi_mode;
+ int ret;
INIT_LIST_HEAD(&isc->subdev_entities);
@@ -348,23 +349,24 @@ static int xisc_parse_dt(struct device *dev, struct isc_device *isc)
for_each_endpoint_of_node(np, epn) {
struct v4l2_fwnode_endpoint v4l2_epn = { .bus_type = 0 };
- int ret;
ret = v4l2_fwnode_endpoint_parse(of_fwnode_handle(epn),
&v4l2_epn);
if (ret) {
- of_node_put(epn);
dev_err(dev, "Could not parse the endpoint\n");
- return -EINVAL;
+ of_node_put(epn);
+ ret = -EINVAL;
+ goto err_cleanup;
}
subdev_entity = devm_kzalloc(dev, sizeof(*subdev_entity),
GFP_KERNEL);
if (!subdev_entity) {
of_node_put(epn);
- return -ENOMEM;
+ ret = -ENOMEM;
+ goto err_cleanup;
}
- subdev_entity->epn = epn;
+ subdev_entity->epn = of_node_get(epn);
flags = v4l2_epn.bus.parallel.flags;
@@ -388,6 +390,11 @@ static int xisc_parse_dt(struct device *dev, struct isc_device *isc)
}
return 0;
+
+err_cleanup:
+ list_for_each_entry(subdev_entity, &isc->subdev_entities, list)
+ of_node_put(subdev_entity->epn);
+ return ret;
}
static int microchip_xisc_probe(struct platform_device *pdev)
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [PATCH 5.15.y] media: microchip-isc: take a reference on the parsed endpoints
2026-11-04 14:17 FAILED: patch "[PATCH] media: microchip-isc: take a reference on the parsed" failed to apply to 5.15-stable tree gregkh
@ 2026-11-05 0:16 ` Sasha Levin
0 siblings, 0 replies; 2+ messages in thread
From: Sasha Levin @ 2026-11-05 0:16 UTC (permalink / raw)
To: stable; +Cc: Balakrishnan Sambath, Eugen Hristev, Hans Verkuil, Sasha Levin
From: Balakrishnan Sambath <balakrishnan.s@microchip.com>
[ Upstream commit f2eb2fd388bf3f1959556a326e797cacca341c86 ]
for_each_endpoint_of_node() drops the reference on the current node as
it advances. xisc_parse_dt() and isc_parse_dt() store the node in
subdev_entity->epn and release it later with of_node_put(), but never
took their own reference, so the stored pointer refers to an
already-released node. This underflows the refcount and can
use-after-free, reachable through the camera device tree overlay.
Take a reference with of_node_get() when storing the node, and drop it
in microchip_isc_subdev_cleanup() so the entities the bind loop never
reaches on an early exit do not leak it.
Fixes: c9aa973884a1 ("media: atmel: atmel-isc: add microchip-xisc driver")
Fixes: d6701f13bd07 ("media: atmel: Use v4l2_async_notifier_add_fwnode_remote_subdev")
Cc: stable@vger.kernel.org
Signed-off-by: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
[ sashal: adapted error cleanup to existing explicit endpoint loops using break exits instead of goto err_cleanup ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/atmel/atmel-isc-base.c | 6 ++++++
drivers/media/platform/atmel/atmel-sama5d2-isc.c | 5 ++++-
drivers/media/platform/atmel/atmel-sama7g5-isc.c | 5 ++++-
3 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/atmel/atmel-isc-base.c b/drivers/media/platform/atmel/atmel-isc-base.c
index f768be3c40595..eeaf91d80acd7 100644
--- a/drivers/media/platform/atmel/atmel-isc-base.c
+++ b/drivers/media/platform/atmel/atmel-isc-base.c
@@ -2219,6 +2219,12 @@ void isc_subdev_cleanup(struct isc_device *isc)
list_for_each_entry(subdev_entity, &isc->subdev_entities, list) {
v4l2_async_notifier_unregister(&subdev_entity->notifier);
v4l2_async_notifier_cleanup(&subdev_entity->notifier);
+ /*
+ * Release the endpoint reference taken while parsing. It is
+ * NULL for entities the bind loop already consumed, so this
+ * only drops the ones left over on an early exit.
+ */
+ of_node_put(subdev_entity->epn);
}
INIT_LIST_HEAD(&isc->subdev_entities);
diff --git a/drivers/media/platform/atmel/atmel-sama5d2-isc.c b/drivers/media/platform/atmel/atmel-sama5d2-isc.c
index 7421bc51709c4..cf96d40828ab5 100644
--- a/drivers/media/platform/atmel/atmel-sama5d2-isc.c
+++ b/drivers/media/platform/atmel/atmel-sama5d2-isc.c
@@ -354,7 +354,7 @@ static int isc_parse_dt(struct device *dev, struct isc_device *isc)
ret = -ENOMEM;
break;
}
- subdev_entity->epn = epn;
+ subdev_entity->epn = of_node_get(epn);
flags = v4l2_epn.bus.parallel.flags;
@@ -375,6 +375,9 @@ static int isc_parse_dt(struct device *dev, struct isc_device *isc)
}
of_node_put(epn);
+ list_for_each_entry(subdev_entity, &isc->subdev_entities, list)
+ of_node_put(subdev_entity->epn);
+
return ret;
}
diff --git a/drivers/media/platform/atmel/atmel-sama7g5-isc.c b/drivers/media/platform/atmel/atmel-sama7g5-isc.c
index a4defc30cf412..3183ab2345c8b 100644
--- a/drivers/media/platform/atmel/atmel-sama7g5-isc.c
+++ b/drivers/media/platform/atmel/atmel-sama7g5-isc.c
@@ -344,7 +344,7 @@ static int xisc_parse_dt(struct device *dev, struct isc_device *isc)
ret = -ENOMEM;
break;
}
- subdev_entity->epn = epn;
+ subdev_entity->epn = of_node_get(epn);
flags = v4l2_epn.bus.parallel.flags;
@@ -368,6 +368,9 @@ static int xisc_parse_dt(struct device *dev, struct isc_device *isc)
}
of_node_put(epn);
+ list_for_each_entry(subdev_entity, &isc->subdev_entities, list)
+ of_node_put(subdev_entity->epn);
+
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-11-05 0:16 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-04 14:17 FAILED: patch "[PATCH] media: microchip-isc: take a reference on the parsed" failed to apply to 5.15-stable tree gregkh
2026-11-05 0:16 ` [PATCH 5.15.y] media: microchip-isc: take a reference on the parsed endpoints Sasha Levin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox