releases/5.15.87/staging-media-tegra-video-fix-device_node-use-after-free.patch

   1 From c4d344163c3a7f90712525f931a6c016bbb35e18 Mon Sep 17 00:00:00 2001
   2 From: Luca Ceresoli <luca.ceresoli@bootlin.com>
   3 Date: Wed, 2 Nov 2022 12:01:02 +0100
   4 Subject: staging: media: tegra-video: fix device_node use after free
   5
   6 From: Luca Ceresoli <luca.ceresoli@bootlin.com>
   7
   8 commit c4d344163c3a7f90712525f931a6c016bbb35e18 upstream.
   9
  10 At probe time this code path is followed:
  11
  12  * tegra_csi_init
  13    * tegra_csi_channels_alloc
  14      * for_each_child_of_node(node, channel) -- iterates over channels
  15        * automatically gets 'channel'
  16          * tegra_csi_channel_alloc()
  17            * saves into chan->of_node a pointer to the channel OF node
  18        * automatically gets and puts 'channel'
  19        * now the node saved in chan->of_node has refcount 0, can disappear
  20    * tegra_csi_channels_init
  21      * iterates over channels
  22        * tegra_csi_channel_init -- uses chan->of_node
  23
  24 After that, chan->of_node keeps storing the node until the device is
  25 removed.
  26
  27 of_node_get() the node and of_node_put() it during teardown to avoid any
  28 risk.
  29
  30 Fixes: 1ebaeb09830f ("media: tegra-video: Add support for external sensor capture")
  31 Cc: stable@vger.kernel.org
  32 Cc: Sowjanya Komatineni <skomatineni@nvidia.com>
  33 Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
  34 Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
  35 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  36 ---
  37  drivers/staging/media/tegra-video/csi.c |    3 ++-
  38  1 file changed, 2 insertions(+), 1 deletion(-)
  39
  40 --- a/drivers/staging/media/tegra-video/csi.c
  41 +++ b/drivers/staging/media/tegra-video/csi.c
  42 @@ -433,7 +433,7 @@ static int tegra_csi_channel_alloc(struc
  43         for (i = 0; i < chan->numgangports; i++)
  44                 chan->csi_port_nums[i] = port_num + i * CSI_PORTS_PER_BRICK;
  45
  46 -       chan->of_node = node;
  47 +       chan->of_node = of_node_get(node);
  48         chan->numpads = num_pads;
  49         if (num_pads & 0x2) {
  50                 chan->pads[0].flags = MEDIA_PAD_FL_SINK;
  51 @@ -641,6 +641,7 @@ static void tegra_csi_channels_cleanup(s
  52                         media_entity_cleanup(&subdev->entity);
  53                 }
  54
  55 +               of_node_put(chan->of_node);
  56                 list_del(&chan->list);
  57                 kfree(chan);
  58         }