Use the new of_get_compatible_child() helper to lookup the nfc child node instead of using of_find_compatible_node(), which searches the entire tree from a given start node and thus can return an unrelated (i.e. non-child) node.
This also addresses a potential use-after-free (e.g. after probe deferral) as the tree-wide helper drops a reference to its first argument (i.e. the node of the device being probed).
While at it, also fix a related nfc-node reference leak.
Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") Cc: stable stable@vger.kernel.org # 4.11 Cc: Nicolas Ferre nicolas.ferre@microchip.com Cc: Josh Wu rainyfeeling@outlook.com Cc: Boris Brezillon boris.brezillon@bootlin.com Signed-off-by: Johan Hovold johan@kernel.org --- drivers/mtd/nand/raw/atmel/nand-controller.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c index a068b214ebaa..d3dfe63956ac 100644 --- a/drivers/mtd/nand/raw/atmel/nand-controller.c +++ b/drivers/mtd/nand/raw/atmel/nand-controller.c @@ -2061,8 +2061,7 @@ atmel_hsmc_nand_controller_legacy_init(struct atmel_hsmc_nand_controller *nc) int ret;
nand_np = dev->of_node; - nfc_np = of_find_compatible_node(dev->of_node, NULL, - "atmel,sama5d3-nfc"); + nfc_np = of_get_compatible_child(dev->of_node, "atmel,sama5d3-nfc");
nc->clk = of_clk_get(nfc_np, 0); if (IS_ERR(nc->clk)) { @@ -2472,15 +2471,19 @@ static int atmel_nand_controller_probe(struct platform_device *pdev) }
if (caps->legacy_of_bindings) { + struct device_node *nfc_node; u32 ale_offs = 21;
/* * If we are parsing legacy DT props and the DT contains a * valid NFC node, forward the request to the sama5 logic. */ - if (of_find_compatible_node(pdev->dev.of_node, NULL, - "atmel,sama5d3-nfc")) + nfc_node = of_get_compatible_child(pdev->dev.of_node, + "atmel,sama5d3-nfc"); + if (nfc_node) { caps = &atmel_sama5_nand_caps; + of_node_put(nfc_node); + }
/* * Even if the compatible says we are dealing with an
Hi Johan
On Mon, 27 Aug 2018 10:21:49 +0200 Johan Hovold johan@kernel.org wrote:
Use the new of_get_compatible_child() helper to lookup the nfc child node instead of using of_find_compatible_node(), which searches the entire tree from a given start node and thus can return an unrelated (i.e. non-child) node.
This also addresses a potential use-after-free (e.g. after probe deferral) as the tree-wide helper drops a reference to its first argument (i.e. the node of the device being probed).
While at it, also fix a related nfc-node reference leak.
Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") Cc: stable stable@vger.kernel.org # 4.11 Cc: Nicolas Ferre nicolas.ferre@microchip.com Cc: Josh Wu rainyfeeling@outlook.com Cc: Boris Brezillon boris.brezillon@bootlin.com Signed-off-by: Johan Hovold johan@kernel.org
Acked-by: Boris Brezillon boris.brezillon@bootlin.com
I'll let Miquel queue this patch to the nand/next branch, unless you want it to be merged in 4.19, in which case I'll queue it to the mtd/fixes branch.
Thanks,
Boris
drivers/mtd/nand/raw/atmel/nand-controller.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c index a068b214ebaa..d3dfe63956ac 100644 --- a/drivers/mtd/nand/raw/atmel/nand-controller.c +++ b/drivers/mtd/nand/raw/atmel/nand-controller.c @@ -2061,8 +2061,7 @@ atmel_hsmc_nand_controller_legacy_init(struct atmel_hsmc_nand_controller *nc) int ret; nand_np = dev->of_node;
- nfc_np = of_find_compatible_node(dev->of_node, NULL,
"atmel,sama5d3-nfc");
- nfc_np = of_get_compatible_child(dev->of_node, "atmel,sama5d3-nfc");
nc->clk = of_clk_get(nfc_np, 0); if (IS_ERR(nc->clk)) { @@ -2472,15 +2471,19 @@ static int atmel_nand_controller_probe(struct platform_device *pdev) } if (caps->legacy_of_bindings) {
struct device_node *nfc_node;/* * If we are parsing legacy DT props and the DT contains a * valid NFC node, forward the request to the sama5 logic. */
if (of_find_compatible_node(pdev->dev.of_node, NULL,"atmel,sama5d3-nfc"))
nfc_node = of_get_compatible_child(pdev->dev.of_node,"atmel,sama5d3-nfc");if (nfc_node) { caps = &atmel_sama5_nand_caps;of_node_put(nfc_node);}/* * Even if the compatible says we are dealing with an
On Mon, Aug 27, 2018 at 10:28:20AM +0200, Boris Brezillon wrote:
Hi Johan
On Mon, 27 Aug 2018 10:21:49 +0200 Johan Hovold johan@kernel.org wrote:
Use the new of_get_compatible_child() helper to lookup the nfc child node instead of using of_find_compatible_node(), which searches the entire tree from a given start node and thus can return an unrelated (i.e. non-child) node.
This also addresses a potential use-after-free (e.g. after probe deferral) as the tree-wide helper drops a reference to its first argument (i.e. the node of the device being probed).
While at it, also fix a related nfc-node reference leak.
Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") Cc: stable stable@vger.kernel.org # 4.11 Cc: Nicolas Ferre nicolas.ferre@microchip.com Cc: Josh Wu rainyfeeling@outlook.com Cc: Boris Brezillon boris.brezillon@bootlin.com Signed-off-by: Johan Hovold johan@kernel.org
Acked-by: Boris Brezillon boris.brezillon@bootlin.com
Thanks for the ack.
I'll let Miquel queue this patch to the nand/next branch, unless you want it to be merged in 4.19, in which case I'll queue it to the mtd/fixes branch.
Note that there's a dependency on the first patch of the series which adds the new helper. Rob can pick up the entire series if the various maintainers agree, otherwise I'll try to get at the least the helper into -rc2.
I'd prefer getting the use-after-frees fixed in 4.19, but queuing for 4.20 should be fine too.
Thanks, Johan
On Mon, 27 Aug 2018 10:44:14 +0200 Johan Hovold johan@kernel.org wrote:
On Mon, Aug 27, 2018 at 10:28:20AM +0200, Boris Brezillon wrote:
Hi Johan
On Mon, 27 Aug 2018 10:21:49 +0200 Johan Hovold johan@kernel.org wrote:
Use the new of_get_compatible_child() helper to lookup the nfc child node instead of using of_find_compatible_node(), which searches the entire tree from a given start node and thus can return an unrelated (i.e. non-child) node.
This also addresses a potential use-after-free (e.g. after probe deferral) as the tree-wide helper drops a reference to its first argument (i.e. the node of the device being probed).
While at it, also fix a related nfc-node reference leak.
Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") Cc: stable stable@vger.kernel.org # 4.11 Cc: Nicolas Ferre nicolas.ferre@microchip.com Cc: Josh Wu rainyfeeling@outlook.com Cc: Boris Brezillon boris.brezillon@bootlin.com Signed-off-by: Johan Hovold johan@kernel.org
Acked-by: Boris Brezillon boris.brezillon@bootlin.com
Thanks for the ack.
I'll let Miquel queue this patch to the nand/next branch, unless you want it to be merged in 4.19, in which case I'll queue it to the mtd/fixes branch.
Note that there's a dependency on the first patch of the series which adds the new helper.
I was not Cc-ed on this patch :P.
Rob can pick up the entire series if the various maintainers agree, otherwise I'll try to get at the least the helper into -rc2.
If everything goes in 4.19-rc2 through Rob's tree that's fine, but if it's queued for 4.20 we might need an immutable tag just in case we queue conflicting changes to the NAND tree.
Thanks,
Boris
On Mon, Aug 27, 2018 at 10:48:42AM +0200, Boris Brezillon wrote:
On Mon, 27 Aug 2018 10:44:14 +0200 Johan Hovold johan@kernel.org wrote:
On Mon, Aug 27, 2018 at 10:28:20AM +0200, Boris Brezillon wrote:
Hi Johan
On Mon, 27 Aug 2018 10:21:49 +0200 Johan Hovold johan@kernel.org wrote:
Use the new of_get_compatible_child() helper to lookup the nfc child node instead of using of_find_compatible_node(), which searches the entire tree from a given start node and thus can return an unrelated (i.e. non-child) node.
This also addresses a potential use-after-free (e.g. after probe deferral) as the tree-wide helper drops a reference to its first argument (i.e. the node of the device being probed).
While at it, also fix a related nfc-node reference leak.
Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") Cc: stable stable@vger.kernel.org # 4.11 Cc: Nicolas Ferre nicolas.ferre@microchip.com Cc: Josh Wu rainyfeeling@outlook.com Cc: Boris Brezillon boris.brezillon@bootlin.com Signed-off-by: Johan Hovold johan@kernel.org
Acked-by: Boris Brezillon boris.brezillon@bootlin.com
Thanks for the ack.
I'll let Miquel queue this patch to the nand/next branch, unless you want it to be merged in 4.19, in which case I'll queue it to the mtd/fixes branch.
Note that there's a dependency on the first patch of the series which adds the new helper.
I was not Cc-ed on this patch :P.
Yeah, sorry about that. I made sure everyone was CCed on the cover letter, but guess I could have reused that list for the helper as well.
Rob can pick up the entire series if the various maintainers agree, otherwise I'll try to get at the least the helper into -rc2.
If everything goes in 4.19-rc2 through Rob's tree that's fine, but if it's queued for 4.20 we might need an immutable tag just in case we queue conflicting changes to the NAND tree.
Ok, thanks.
Johan
On Mon, Aug 27, 2018 at 4:44 AM Johan Hovold johan@kernel.org wrote:
On Mon, Aug 27, 2018 at 10:48:42AM +0200, Boris Brezillon wrote:
On Mon, 27 Aug 2018 10:44:14 +0200 Johan Hovold johan@kernel.org wrote:
On Mon, Aug 27, 2018 at 10:28:20AM +0200, Boris Brezillon wrote:
Hi Johan
On Mon, 27 Aug 2018 10:21:49 +0200 Johan Hovold johan@kernel.org wrote:
Use the new of_get_compatible_child() helper to lookup the nfc child node instead of using of_find_compatible_node(), which searches the entire tree from a given start node and thus can return an unrelated (i.e. non-child) node.
This also addresses a potential use-after-free (e.g. after probe deferral) as the tree-wide helper drops a reference to its first argument (i.e. the node of the device being probed).
While at it, also fix a related nfc-node reference leak.
Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") Cc: stable stable@vger.kernel.org # 4.11 Cc: Nicolas Ferre nicolas.ferre@microchip.com Cc: Josh Wu rainyfeeling@outlook.com Cc: Boris Brezillon boris.brezillon@bootlin.com Signed-off-by: Johan Hovold johan@kernel.org
Acked-by: Boris Brezillon boris.brezillon@bootlin.com
Thanks for the ack.
I'll let Miquel queue this patch to the nand/next branch, unless you want it to be merged in 4.19, in which case I'll queue it to the mtd/fixes branch.
Note that there's a dependency on the first patch of the series which adds the new helper.
I was not Cc-ed on this patch :P.
Yeah, sorry about that. I made sure everyone was CCed on the cover letter, but guess I could have reused that list for the helper as well.
Rob can pick up the entire series if the various maintainers agree, otherwise I'll try to get at the least the helper into -rc2.
If everything goes in 4.19-rc2 through Rob's tree that's fine, but if it's queued for 4.20 we might need an immutable tag just in case we queue conflicting changes to the NAND tree.
Ok, thanks.
Hi Boris, can you pick this one up. It conflicts with "mtd: rawnand: atmel: Fix potential NULL pointer dereference"
Rob
On Tue, 23 Oct 2018 13:28:09 -0500 Rob Herring robh+dt@kernel.org wrote:
On Mon, Aug 27, 2018 at 4:44 AM Johan Hovold johan@kernel.org wrote:
On Mon, Aug 27, 2018 at 10:48:42AM +0200, Boris Brezillon wrote:
On Mon, 27 Aug 2018 10:44:14 +0200 Johan Hovold johan@kernel.org wrote:
On Mon, Aug 27, 2018 at 10:28:20AM +0200, Boris Brezillon wrote:
Hi Johan
On Mon, 27 Aug 2018 10:21:49 +0200 Johan Hovold johan@kernel.org wrote:
Use the new of_get_compatible_child() helper to lookup the nfc child node instead of using of_find_compatible_node(), which searches the entire tree from a given start node and thus can return an unrelated (i.e. non-child) node.
This also addresses a potential use-after-free (e.g. after probe deferral) as the tree-wide helper drops a reference to its first argument (i.e. the node of the device being probed).
While at it, also fix a related nfc-node reference leak.
Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") Cc: stable stable@vger.kernel.org # 4.11 Cc: Nicolas Ferre nicolas.ferre@microchip.com Cc: Josh Wu rainyfeeling@outlook.com Cc: Boris Brezillon boris.brezillon@bootlin.com Signed-off-by: Johan Hovold johan@kernel.org
Acked-by: Boris Brezillon boris.brezillon@bootlin.com
Thanks for the ack.
I'll let Miquel queue this patch to the nand/next branch, unless you want it to be merged in 4.19, in which case I'll queue it to the mtd/fixes branch.
Note that there's a dependency on the first patch of the series which adds the new helper.
I was not Cc-ed on this patch :P.
Yeah, sorry about that. I made sure everyone was CCed on the cover letter, but guess I could have reused that list for the helper as well.
Rob can pick up the entire series if the various maintainers agree, otherwise I'll try to get at the least the helper into -rc2.
If everything goes in 4.19-rc2 through Rob's tree that's fine, but if it's queued for 4.20 we might need an immutable tag just in case we queue conflicting changes to the NAND tree.
Ok, thanks.
Hi Boris, can you pick this one up. It conflicts with "mtd: rawnand: atmel: Fix potential NULL pointer dereference"
Sure, I'll queue it for -rc2.
On Tue, Oct 23, 2018 at 08:51:17PM +0200, Boris Brezillon wrote:
On Tue, 23 Oct 2018 13:28:09 -0500 Rob Herring robh+dt@kernel.org wrote:
On Mon, Aug 27, 2018 at 4:44 AM Johan Hovold johan@kernel.org wrote:
On Mon, Aug 27, 2018 at 10:48:42AM +0200, Boris Brezillon wrote:
On Mon, 27 Aug 2018 10:44:14 +0200 Johan Hovold johan@kernel.org wrote:
On Mon, Aug 27, 2018 at 10:28:20AM +0200, Boris Brezillon wrote:
Hi Johan
On Mon, 27 Aug 2018 10:21:49 +0200 Johan Hovold johan@kernel.org wrote: > Use the new of_get_compatible_child() helper to lookup the nfc child > node instead of using of_find_compatible_node(), which searches the > entire tree from a given start node and thus can return an unrelated > (i.e. non-child) node. > > This also addresses a potential use-after-free (e.g. after probe > deferral) as the tree-wide helper drops a reference to its first > argument (i.e. the node of the device being probed). > > While at it, also fix a related nfc-node reference leak. > > Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") > Cc: stable stable@vger.kernel.org # 4.11 > Cc: Nicolas Ferre nicolas.ferre@microchip.com > Cc: Josh Wu rainyfeeling@outlook.com > Cc: Boris Brezillon boris.brezillon@bootlin.com > Signed-off-by: Johan Hovold johan@kernel.org
Acked-by: Boris Brezillon boris.brezillon@bootlin.com
Thanks for the ack.
I'll let Miquel queue this patch to the nand/next branch, unless you want it to be merged in 4.19, in which case I'll queue it to the mtd/fixes branch.
Note that there's a dependency on the first patch of the series which adds the new helper.
I was not Cc-ed on this patch :P.
Yeah, sorry about that. I made sure everyone was CCed on the cover letter, but guess I could have reused that list for the helper as well.
Rob can pick up the entire series if the various maintainers agree, otherwise I'll try to get at the least the helper into -rc2.
If everything goes in 4.19-rc2 through Rob's tree that's fine, but if it's queued for 4.20 we might need an immutable tag just in case we queue conflicting changes to the NAND tree.
Ok, thanks.
Hi Boris, can you pick this one up. It conflicts with "mtd: rawnand: atmel: Fix potential NULL pointer dereference"
Sure, I'll queue it for -rc2.
This one hasn't showed up in -next yet, so sending a reminder.
Johan
On Thu, 15 Nov 2018 15:26:48 +0100 Johan Hovold johan@kernel.org wrote:
On Tue, Oct 23, 2018 at 08:51:17PM +0200, Boris Brezillon wrote:
On Tue, 23 Oct 2018 13:28:09 -0500 Rob Herring robh+dt@kernel.org wrote:
On Mon, Aug 27, 2018 at 4:44 AM Johan Hovold johan@kernel.org wrote:
On Mon, Aug 27, 2018 at 10:48:42AM +0200, Boris Brezillon wrote:
On Mon, 27 Aug 2018 10:44:14 +0200 Johan Hovold johan@kernel.org wrote:
On Mon, Aug 27, 2018 at 10:28:20AM +0200, Boris Brezillon wrote: > Hi Johan > > On Mon, 27 Aug 2018 10:21:49 +0200 > Johan Hovold johan@kernel.org wrote: > > > Use the new of_get_compatible_child() helper to lookup the nfc child > > node instead of using of_find_compatible_node(), which searches the > > entire tree from a given start node and thus can return an unrelated > > (i.e. non-child) node. > > > > This also addresses a potential use-after-free (e.g. after probe > > deferral) as the tree-wide helper drops a reference to its first > > argument (i.e. the node of the device being probed). > > > > While at it, also fix a related nfc-node reference leak. > > > > Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") > > Cc: stable stable@vger.kernel.org # 4.11 > > Cc: Nicolas Ferre nicolas.ferre@microchip.com > > Cc: Josh Wu rainyfeeling@outlook.com > > Cc: Boris Brezillon boris.brezillon@bootlin.com > > Signed-off-by: Johan Hovold johan@kernel.org > > Acked-by: Boris Brezillon boris.brezillon@bootlin.com
Thanks for the ack. > I'll let Miquel queue this patch to the nand/next branch, unless you > want it to be merged in 4.19, in which case I'll queue it to the > mtd/fixes branch.
Note that there's a dependency on the first patch of the series which adds the new helper.
I was not Cc-ed on this patch :P.
Yeah, sorry about that. I made sure everyone was CCed on the cover letter, but guess I could have reused that list for the helper as well.
Rob can pick up the entire series if the various maintainers agree, otherwise I'll try to get at the least the helper into -rc2.
If everything goes in 4.19-rc2 through Rob's tree that's fine, but if it's queued for 4.20 we might need an immutable tag just in case we queue conflicting changes to the NAND tree.
Ok, thanks.
Hi Boris, can you pick this one up. It conflicts with "mtd: rawnand: atmel: Fix potential NULL pointer dereference"
Sure, I'll queue it for -rc2.
This one hasn't showed up in -next yet, so sending a reminder.
Applied (thanks for the reminder, I had forgotten :-)). It should show up in -rc4.
Thanks,
Boris
linux-stable-mirror@lists.linaro.org
-
Boris Brezillon -
Johan Hovold -
Rob Herring