| Message ID | 20241218035106.1436405-1-joe@pf.is.s.u-tokyo.ac.jp (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 572af9f284669d31d9175122bbef9bc62cea8ded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [v4] net: mdiobus: fix an OF node reference leak | expand |
On Wed, Dec 18, 2024 at 12:51:06PM +0900, Joe Hattori wrote: > fwnode_find_mii_timestamper() calls of_parse_phandle_with_fixed_args() > but does not decrement the refcount of the obtained OF node. Add an > of_node_put() call before returning from the function. > > This bug was detected by an experimental static analysis tool that I am > developing. > > Fixes: bc1bee3b87ee ("net: mdiobus: Introduce fwnode_mdiobus_register_phy()") > Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Andrew
Hello: This patch was applied to netdev/net.git (main) by Paolo Abeni <pabeni@redhat.com>: On Wed, 18 Dec 2024 12:51:06 +0900 you wrote: > fwnode_find_mii_timestamper() calls of_parse_phandle_with_fixed_args() > but does not decrement the refcount of the obtained OF node. Add an > of_node_put() call before returning from the function. > > This bug was detected by an experimental static analysis tool that I am > developing. > > [...] Here is the summary with links: - [v4] net: mdiobus: fix an OF node reference leak https://git.kernel.org/netdev/net/c/572af9f28466 You are awesome, thank you!
diff --git a/drivers/net/mdio/fwnode_mdio.c b/drivers/net/mdio/fwnode_mdio.c index b156493d7084..aea0f0357568 100644 --- a/drivers/net/mdio/fwnode_mdio.c +++ b/drivers/net/mdio/fwnode_mdio.c @@ -40,6 +40,7 @@ fwnode_find_pse_control(struct fwnode_handle *fwnode) static struct mii_timestamper * fwnode_find_mii_timestamper(struct fwnode_handle *fwnode) { + struct mii_timestamper *mii_ts; struct of_phandle_args arg; int err; @@ -53,10 +54,16 @@ fwnode_find_mii_timestamper(struct fwnode_handle *fwnode) else if (err) return ERR_PTR(err); - if (arg.args_count != 1) - return ERR_PTR(-EINVAL); + if (arg.args_count != 1) { + mii_ts = ERR_PTR(-EINVAL); + goto put_node; + } + + mii_ts = register_mii_timestamper(arg.np, arg.args[0]); - return register_mii_timestamper(arg.np, arg.args[0]); +put_node: + of_node_put(arg.np); + return mii_ts; } int fwnode_mdiobus_phy_device_register(struct mii_bus *mdio,
fwnode_find_mii_timestamper() calls of_parse_phandle_with_fixed_args() but does not decrement the refcount of the obtained OF node. Add an of_node_put() call before returning from the function. This bug was detected by an experimental static analysis tool that I am developing. Fixes: bc1bee3b87ee ("net: mdiobus: Introduce fwnode_mdiobus_register_phy()") Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp> --- Changes in v4: - Reorder the variables. - Add and use put_node label for cleanup. Changes in v3: - Call of_node_put() when arg.args_count != 1 holds. Changes in v2: - Call of_node_put() after calling register_mii_timestamper() to avoid UAF. --- drivers/net/mdio/fwnode_mdio.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)