linux/drivers/net/dsa/sja1105
Vladimir Oltean ed5d2937a6 net: dsa: sja1105: fix use-after-free after calling of_find_compatible_node, or worse
It seems that of_find_compatible_node has a weird calling convention in
which it calls of_node_put() on the "from" node argument, instead of
leaving that up to the caller. This comes from the fact that
of_find_compatible_node with a non-NULL "from" argument it only supposed
to be used as the iterator function of for_each_compatible_node(). OF
iterator functions call of_node_get on the next OF node and of_node_put()
on the previous one.

When of_find_compatible_node calls of_node_put, it actually never
expects the refcount to drop to zero, because the call is done under the
atomic devtree_lock context, and when the refcount drops to zero it
triggers a kobject and a sysfs file deletion, which assume blocking
context.

So any driver call to of_find_compatible_node is probably buggy because
an unexpected of_node_put() takes place.

What should be done is to use the of_get_compatible_child() function.

Fixes: 5a8f09748e ("net: dsa: sja1105: register the MDIO buses for 100base-T1 and 100base-TX")
Link: https://lore.kernel.org/netdev/20210814010139.kzryimmp4rizlznt@skbuf/
Suggested-by: Frank Rowand <frowand.list@gmail.com>
Suggested-by: Rob Herring <robh+dt@kernel.org>
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-08-18 10:21:01 +01:00
..
Kconfig net: dsa: sja1105: document the SJA1110 in the Kconfig 2021-06-24 12:55:57 -07:00
Makefile net: dsa: sja1105: register the MDIO buses for 100base-T1 and 100base-TX 2021-06-08 14:37:16 -07:00
sja1105_clocking.c net: dsa: sja1105: properly power down the microcontroller clock for SJA1110 2021-06-18 12:26:17 -07:00
sja1105_devlink.c net: dsa: propagate extack to .port_vlan_filtering 2021-02-14 17:38:12 -08:00
sja1105_dynamic_config.c net: dsa: sja1105: fix static FDB writes for SJA1110 2021-08-02 14:28:28 +01:00
sja1105_dynamic_config.h net: dsa: sja1105: add support for the SJA1110 switch family 2021-06-08 14:37:16 -07:00
sja1105_ethtool.c net: dsa: sja1105: don't use burst SPI reads for port statistics 2021-05-21 14:01:41 -07:00
sja1105_flower.c net: dsa: sja1105: dimension the data structures for a larger port count 2021-05-24 13:59:03 -07:00
sja1105_main.c net: dsa: sja1105: unregister the MDIO buses during teardown 2021-08-12 10:53:40 +01:00
sja1105_mdio.c net: dsa: sja1105: fix use-after-free after calling of_find_compatible_node, or worse 2021-08-18 10:21:01 +01:00
sja1105_ptp.c net: dsa: sja1105: implement TX timestamping for SJA1110 2021-06-11 12:45:38 -07:00
sja1105_ptp.h net: dsa: sja1105: implement TX timestamping for SJA1110 2021-06-11 12:45:38 -07:00
sja1105_spi.c net: dsa: sja1105: properly power down the microcontroller clock for SJA1110 2021-06-18 12:26:17 -07:00
sja1105_static_config.c net: dsa: sja1105: allow the TTEthernet configuration in the static config for SJA1110 2021-06-18 12:26:17 -07:00
sja1105_static_config.h net: dsa: add support for the SJA1110 native tagging protocol 2021-06-11 12:45:38 -07:00
sja1105_tas.c net: dsa: sja1105: parameterize the number of ports 2021-05-24 13:59:03 -07:00
sja1105_tas.h net: dsa: sja1105: dimension the data structures for a larger port count 2021-05-24 13:59:03 -07:00
sja1105_vl.c net: dsa: sja1105: dimension the data structures for a larger port count 2021-05-24 13:59:03 -07:00
sja1105_vl.h net: dsa: sja1105: suppress -Wmissing-prototypes in sja1105_vl.c 2020-06-01 12:13:47 -07:00
sja1105.h net: dsa: sja1105: properly power down the microcontroller clock for SJA1110 2021-06-18 12:26:17 -07:00