memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()

[ Upstream commit b9784e5cde1f9fb83661a70e580e381ae1264d12 ]

As of_find_node_by_name() release the reference of the argument device
node, tegra_emc_find_node_by_ram_code() releases some device nodes while
still in use, resulting in possible UAFs. According to the bindings and
the in-tree DTS files, the "emc-tables" node is always device's child
node with the property "nvidia,use-ram-code", and the "lpddr2" node is a
child of the "emc-tables" node. Thus utilize the
for_each_child_of_node() macro and of_get_child_by_name() instead of
of_find_node_by_name() to simplify the code.

This bug was found by an experimental verification tool that I am
developing.

Fixes: 96e5da7c8424 ("memory: tegra: Introduce Tegra20 EMC driver")
Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20241217091434.1993597-1-joe@pf.is.s.u-tokyo.ac.jp
Link: https://lore.kernel.org/r/20241218024415.2494267-3-joe@pf.is.s.u-tokyo.ac.jp
[krzysztof: applied v1, adjust the commit msg to incorporate v2 parts]
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/memory/tegra/tegra20-emc.c b/drivers/memory/tegra/tegra20-emc.c
index 497b6edbf3ca107ec0b6001b15ce4ca34feaf340..2ac074b96f8593fd48eb22d421b51bbcd17fe19b 100644 (file)
--- a/drivers/memory/tegra/tegra20-emc.c
+++ b/drivers/memory/tegra/tegra20-emc.c
@@ -477,14 +477,15 @@ tegra_emc_find_node_by_ram_code(struct tegra_emc *emc)
 
        ram_code = tegra_read_ram_code();
 
-       for (np = of_find_node_by_name(dev->of_node, "emc-tables"); np;
-            np = of_find_node_by_name(np, "emc-tables")) {
+       for_each_child_of_node(dev->of_node, np) {
+               if (!of_node_name_eq(np, "emc-tables"))
+                       continue;
                err = of_property_read_u32(np, "nvidia,ram-code", &value);
                if (err || value != ram_code) {
                        struct device_node *lpddr2_np;
                        bool cfg_mismatches = false;
 
-                       lpddr2_np = of_find_node_by_name(np, "lpddr2");
+                       lpddr2_np = of_get_child_by_name(np, "lpddr2");
                        if (lpddr2_np) {
                                const struct lpddr2_info *info;
 
@@ -521,7 +522,6 @@ tegra_emc_find_node_by_ram_code(struct tegra_emc *emc)
                        }
 
                        if (cfg_mismatches) {
-                               of_node_put(np);
                                continue;
                        }
                }