]> git.baikalelectronics.ru Git - kernel.git/commit
net: dsa: sja1105: fix use-after-free after calling of_find_compatible_node, or worse
authorVladimir Oltean <vladimir.oltean@nxp.com>
Tue, 17 Aug 2021 14:52:45 +0000 (17:52 +0300)
committerDavid S. Miller <davem@davemloft.net>
Wed, 18 Aug 2021 09:21:01 +0000 (10:21 +0100)
commited5d2937a6a8f12e7f815748f991990e79ac4cd1
treea921caa781a1eb0288b07f0861d3f8052646ed6e
parent86b9bbd332d0510679c7fedcee3e3bd278be5756
net: dsa: sja1105: fix use-after-free after calling of_find_compatible_node, or worse

It seems that of_find_compatible_node has a weird calling convention in
which it calls of_node_put() on the "from" node argument, instead of
leaving that up to the caller. This comes from the fact that
of_find_compatible_node with a non-NULL "from" argument it only supposed
to be used as the iterator function of for_each_compatible_node(). OF
iterator functions call of_node_get on the next OF node and of_node_put()
on the previous one.

When of_find_compatible_node calls of_node_put, it actually never
expects the refcount to drop to zero, because the call is done under the
atomic devtree_lock context, and when the refcount drops to zero it
triggers a kobject and a sysfs file deletion, which assume blocking
context.

So any driver call to of_find_compatible_node is probably buggy because
an unexpected of_node_put() takes place.

What should be done is to use the of_get_compatible_child() function.

Fixes: 5a8f09748ee7 ("net: dsa: sja1105: register the MDIO buses for 100base-T1 and 100base-TX")
Link: https://lore.kernel.org/netdev/20210814010139.kzryimmp4rizlznt@skbuf/
Suggested-by: Frank Rowand <frowand.list@gmail.com>
Suggested-by: Rob Herring <robh+dt@kernel.org>
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/dsa/sja1105/sja1105_mdio.c