| Message ID | 20221028081926.2320663-1-luca.ceresoli@bootlin.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | staging: media: tegra-video: fix device_node use after free | expand |
On Fri, Oct 28, 2022 at 10:19:26AM +0200, luca.ceresoli@bootlin.com wrote: > From: Luca Ceresoli <luca.ceresoli@bootlin.com> > > At probe time this code path is followed: > > * tegra_csi_init > * tegra_csi_channels_alloc > * for_each_child_of_node(node, channel) -- iterates over channels > * automatically gets 'channel' > * tegra_csi_channel_alloc() > * saves into chan->of_node a pointer to the channel OF node > * automatically gets and puts 'channel' > * now the node saved in chan->of_node has refcount 0, can disappear > * tegra_csi_channels_init > * iterates over channels > * tegra_csi_channel_init -- uses chan->of_node > > After that, chan->of_node keeps storing the node until the device is > removed. > > of_node_get() the node and of_node_put() it during teardown to avoid any > risk. > > Fixes: 1ebaeb09830f ("media: tegra-video: Add support for external sensor capture") > Cc: stable@vger.kernel.org > Cc: Sowjanya Komatineni <skomatineni@nvidia.com> > Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> > --- > drivers/staging/media/tegra-video/csi.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/staging/media/tegra-video/csi.c b/drivers/staging/media/tegra-video/csi.c > index b26e44adb2be..1b05f620b476 100644 > --- a/drivers/staging/media/tegra-video/csi.c > +++ b/drivers/staging/media/tegra-video/csi.c > @@ -433,7 +433,7 @@ static int tegra_csi_channel_alloc(struct tegra_csi *csi, > for (i = 0; i < chan->numgangports; i++) > chan->csi_port_nums[i] = port_num + i * CSI_PORTS_PER_BRICK; > > - chan->of_node = node; > + chan->of_node = of_node_get(node); > chan->numpads = num_pads; > if (num_pads & 0x2) { > chan->pads[0].flags = MEDIA_PAD_FL_SINK; > @@ -640,6 +640,7 @@ static void tegra_csi_channels_cleanup(struct tegra_csi *csi) > media_entity_cleanup(&subdev->entity); > } > > + of_node_put(chan->of_node); > list_del(&chan->list); > kfree(chan); Not related to your patch, but this kind of "one function cleans up everything" style is always buggy. For example, here it should be: - if (chan->mipi) + if (!IS_ERR_OR_NULL(chan->mipi)) tegra_mipi_free(chan->mipi); regards, dan carpenter
Hello Dan, On Fri, 28 Oct 2022 15:34:39 +0300 Dan Carpenter <dan.carpenter@oracle.com> wrote: > On Fri, Oct 28, 2022 at 10:19:26AM +0200, luca.ceresoli@bootlin.com wrote: > > From: Luca Ceresoli <luca.ceresoli@bootlin.com> > > > > At probe time this code path is followed: > > > > * tegra_csi_init > > * tegra_csi_channels_alloc > > * for_each_child_of_node(node, channel) -- iterates over channels > > * automatically gets 'channel' > > * tegra_csi_channel_alloc() > > * saves into chan->of_node a pointer to the channel OF node > > * automatically gets and puts 'channel' > > * now the node saved in chan->of_node has refcount 0, can disappear > > * tegra_csi_channels_init > > * iterates over channels > > * tegra_csi_channel_init -- uses chan->of_node > > > > After that, chan->of_node keeps storing the node until the device is > > removed. > > > > of_node_get() the node and of_node_put() it during teardown to avoid any > > risk. > > > > Fixes: 1ebaeb09830f ("media: tegra-video: Add support for external sensor capture") > > Cc: stable@vger.kernel.org > > Cc: Sowjanya Komatineni <skomatineni@nvidia.com> > > Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> > > --- > > drivers/staging/media/tegra-video/csi.c | 3 ++- > > 1 file changed, 2 insertions(+), 1 deletion(-) > > > > diff --git a/drivers/staging/media/tegra-video/csi.c b/drivers/staging/media/tegra-video/csi.c > > index b26e44adb2be..1b05f620b476 100644 > > --- a/drivers/staging/media/tegra-video/csi.c > > +++ b/drivers/staging/media/tegra-video/csi.c > > @@ -433,7 +433,7 @@ static int tegra_csi_channel_alloc(struct tegra_csi *csi, > > for (i = 0; i < chan->numgangports; i++) > > chan->csi_port_nums[i] = port_num + i * CSI_PORTS_PER_BRICK; > > > > - chan->of_node = node; > > + chan->of_node = of_node_get(node); > > chan->numpads = num_pads; > > if (num_pads & 0x2) { > > chan->pads[0].flags = MEDIA_PAD_FL_SINK; > > @@ -640,6 +640,7 @@ static void tegra_csi_channels_cleanup(struct tegra_csi *csi) > > media_entity_cleanup(&subdev->entity); > > } > > > > + of_node_put(chan->of_node); > > list_del(&chan->list); > > kfree(chan); > > Not related to your patch, but this kind of "one function cleans up > everything" style is always buggy. For example, here it should be: > > - if (chan->mipi) > + if (!IS_ERR_OR_NULL(chan->mipi)) > tegra_mipi_free(chan->mipi); I sort of agree the code could be clearer here, but looking at the code in detail, this cannot happen. chan->mipi is set in one place only, and if it is an error the whole probe fails. So it can be either NULL or a valid pointer here. Regarding my patch, do you think it is valid? Best regards.
On Fri, Oct 28, 2022 at 06:58:47PM +0200, Luca Ceresoli wrote: > Hello Dan, > > On Fri, 28 Oct 2022 15:34:39 +0300 > Dan Carpenter <dan.carpenter@oracle.com> wrote: > > > On Fri, Oct 28, 2022 at 10:19:26AM +0200, luca.ceresoli@bootlin.com wrote: > > > From: Luca Ceresoli <luca.ceresoli@bootlin.com> > > > > > > At probe time this code path is followed: > > > > > > * tegra_csi_init > > > * tegra_csi_channels_alloc > > > * for_each_child_of_node(node, channel) -- iterates over channels > > > * automatically gets 'channel' > > > * tegra_csi_channel_alloc() > > > * saves into chan->of_node a pointer to the channel OF node > > > * automatically gets and puts 'channel' > > > * now the node saved in chan->of_node has refcount 0, can disappear > > > * tegra_csi_channels_init > > > * iterates over channels > > > * tegra_csi_channel_init -- uses chan->of_node > > > > > > After that, chan->of_node keeps storing the node until the device is > > > removed. > > > > > > of_node_get() the node and of_node_put() it during teardown to avoid any > > > risk. > > > > > > Fixes: 1ebaeb09830f ("media: tegra-video: Add support for external sensor capture") > > > Cc: stable@vger.kernel.org > > > Cc: Sowjanya Komatineni <skomatineni@nvidia.com> > > > Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> > > > --- > > > drivers/staging/media/tegra-video/csi.c | 3 ++- > > > 1 file changed, 2 insertions(+), 1 deletion(-) > > > > > > diff --git a/drivers/staging/media/tegra-video/csi.c b/drivers/staging/media/tegra-video/csi.c > > > index b26e44adb2be..1b05f620b476 100644 > > > --- a/drivers/staging/media/tegra-video/csi.c > > > +++ b/drivers/staging/media/tegra-video/csi.c > > > @@ -433,7 +433,7 @@ static int tegra_csi_channel_alloc(struct tegra_csi *csi, > > > for (i = 0; i < chan->numgangports; i++) > > > chan->csi_port_nums[i] = port_num + i * CSI_PORTS_PER_BRICK; > > > > > > - chan->of_node = node; > > > + chan->of_node = of_node_get(node); > > > chan->numpads = num_pads; > > > if (num_pads & 0x2) { > > > chan->pads[0].flags = MEDIA_PAD_FL_SINK; > > > @@ -640,6 +640,7 @@ static void tegra_csi_channels_cleanup(struct tegra_csi *csi) > > > media_entity_cleanup(&subdev->entity); > > > } > > > > > > + of_node_put(chan->of_node); > > > list_del(&chan->list); > > > kfree(chan); > > > > Not related to your patch, but this kind of "one function cleans up > > everything" style is always buggy. For example, here it should be: > > > > - if (chan->mipi) > > + if (!IS_ERR_OR_NULL(chan->mipi)) > > tegra_mipi_free(chan->mipi); > > I sort of agree the code could be clearer here, but looking at the code > in detail, this cannot happen. chan->mipi is set in one place only, and > if it is an error the whole probe fails. So it can be either NULL or a > valid pointer here. I assumed that tegra_csi_channels_cleanup() would clean up if tegra_csi_channel_alloc() fails. Otherwise then that's several different even worse bugs. HINT: Let's all hope my initial analysis was correct. > > Regarding my patch, do you think it is valid? It sort of depends on if the "chan->mipi" dereference can crash like I explained above. If there is no ->mipi crash then the error handling needs to be fixed. regards, dan carpenter
Hello Dan, On Fri, 28 Oct 2022 20:06:34 +0300 Dan Carpenter <dan.carpenter@oracle.com> wrote: > On Fri, Oct 28, 2022 at 06:58:47PM +0200, Luca Ceresoli wrote: > > Hello Dan, > > > > On Fri, 28 Oct 2022 15:34:39 +0300 > > Dan Carpenter <dan.carpenter@oracle.com> wrote: > > > > > On Fri, Oct 28, 2022 at 10:19:26AM +0200, luca.ceresoli@bootlin.com wrote: > > > > From: Luca Ceresoli <luca.ceresoli@bootlin.com> > > > > > > > > At probe time this code path is followed: > > > > > > > > * tegra_csi_init > > > > * tegra_csi_channels_alloc > > > > * for_each_child_of_node(node, channel) -- iterates over channels > > > > * automatically gets 'channel' > > > > * tegra_csi_channel_alloc() > > > > * saves into chan->of_node a pointer to the channel OF node > > > > * automatically gets and puts 'channel' > > > > * now the node saved in chan->of_node has refcount 0, can disappear > > > > * tegra_csi_channels_init > > > > * iterates over channels > > > > * tegra_csi_channel_init -- uses chan->of_node > > > > > > > > After that, chan->of_node keeps storing the node until the device is > > > > removed. > > > > > > > > of_node_get() the node and of_node_put() it during teardown to avoid any > > > > risk. > > > > > > > > Fixes: 1ebaeb09830f ("media: tegra-video: Add support for external sensor capture") > > > > Cc: stable@vger.kernel.org > > > > Cc: Sowjanya Komatineni <skomatineni@nvidia.com> > > > > Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> > > > > --- > > > > drivers/staging/media/tegra-video/csi.c | 3 ++- > > > > 1 file changed, 2 insertions(+), 1 deletion(-) > > > > > > > > diff --git a/drivers/staging/media/tegra-video/csi.c b/drivers/staging/media/tegra-video/csi.c > > > > index b26e44adb2be..1b05f620b476 100644 > > > > --- a/drivers/staging/media/tegra-video/csi.c > > > > +++ b/drivers/staging/media/tegra-video/csi.c > > > > @@ -433,7 +433,7 @@ static int tegra_csi_channel_alloc(struct tegra_csi *csi, > > > > for (i = 0; i < chan->numgangports; i++) > > > > chan->csi_port_nums[i] = port_num + i * CSI_PORTS_PER_BRICK; > > > > > > > > - chan->of_node = node; > > > > + chan->of_node = of_node_get(node); > > > > chan->numpads = num_pads; > > > > if (num_pads & 0x2) { > > > > chan->pads[0].flags = MEDIA_PAD_FL_SINK; > > > > @@ -640,6 +640,7 @@ static void tegra_csi_channels_cleanup(struct tegra_csi *csi) > > > > media_entity_cleanup(&subdev->entity); > > > > } > > > > > > > > + of_node_put(chan->of_node); > > > > list_del(&chan->list); > > > > kfree(chan); > > > > > > Not related to your patch, but this kind of "one function cleans up > > > everything" style is always buggy. For example, here it should be: > > > > > > - if (chan->mipi) > > > + if (!IS_ERR_OR_NULL(chan->mipi)) > > > tegra_mipi_free(chan->mipi); > > > > I sort of agree the code could be clearer here, but looking at the code > > in detail, this cannot happen. chan->mipi is set in one place only, and > > if it is an error the whole probe fails. So it can be either NULL or a > > valid pointer here. > > I assumed that tegra_csi_channels_cleanup() would clean up if > tegra_csi_channel_alloc() fails. Otherwise then that's several > different even worse bugs. > > HINT: Let's all hope my initial analysis was correct. Indeed you have a point. Apologies for having replied in a hurry and for the resulting noise. I'm going to send a patch to fix the chan->mipi mess. However I think the best way to do so would be a oneliner: @@ -491,6 +491,7 @@ static int tegra_csi_channel_alloc(struct tegra_csi *csi, chan->mipi = tegra_mipi_request(csi->dev, node); if (IS_ERR(chan->mipi)) { ret = PTR_ERR(chan->mipi); + chan->mipi = NULL; dev_err(csi->dev, "failed to get mipi device: %d\n", ret); } This would be a correct implementation of the initial intent as it can be inferred from the code, i.e. chan->mipi being either NULL or a valid pointer. This makes sense as chan->mipi is assigned in a single place.
diff --git a/drivers/staging/media/tegra-video/csi.c b/drivers/staging/media/tegra-video/csi.c index b26e44adb2be..1b05f620b476 100644 --- a/drivers/staging/media/tegra-video/csi.c +++ b/drivers/staging/media/tegra-video/csi.c @@ -433,7 +433,7 @@ static int tegra_csi_channel_alloc(struct tegra_csi *csi, for (i = 0; i < chan->numgangports; i++) chan->csi_port_nums[i] = port_num + i * CSI_PORTS_PER_BRICK; - chan->of_node = node; + chan->of_node = of_node_get(node); chan->numpads = num_pads; if (num_pads & 0x2) { chan->pads[0].flags = MEDIA_PAD_FL_SINK; @@ -640,6 +640,7 @@ static void tegra_csi_channels_cleanup(struct tegra_csi *csi) media_entity_cleanup(&subdev->entity); } + of_node_put(chan->of_node); list_del(&chan->list); kfree(chan); }