2021-06-23 13:15:43

by Heikki Krogerus

Subject: [PATCH] software node: Handle software node injection to an existing device properly

The function software_node_notify() - the function that creates
and removes the symlinks between the node and the device - was
called unconditionally in device_add_software_node() and
device_remove_software_node(), but it needs to be called in
those functions only in the special case where the node is
added to a device that has already been registered.

This fixes NULL pointer dereference that happens if
device_remove_software_node() is used with device that was
never registered.

Fixes: b622b24519f5 ("software node: Allow node addition to already existing device")
Reported-and-tested-by: Dominik Brodowski <[email protected]>
Reviewed-by: Andy Shevchenko <[email protected]>
Signed-off-by: Heikki Krogerus <[email protected]>
---
drivers/base/swnode.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
index 3cc11b813f28c..d1f1a82401207 100644
--- a/drivers/base/swnode.c
+++ b/drivers/base/swnode.c
@@ -1045,7 +1045,15 @@ int device_add_software_node(struct device *dev, const struct software_node *nod
}

set_secondary_fwnode(dev, &swnode->fwnode);
- software_node_notify(dev, KOBJ_ADD);
+
+ /*
+ * If the device has been fully registered by the time this function is
+ * called, software_node_notify() must be called separately so that the
+ * symlinks get created and the reference count of the node is kept in
+ * balance.
+ */
+ if (device_is_registered(dev))
+ software_node_notify(dev, KOBJ_ADD);

return 0;
}
@@ -1065,7 +1073,8 @@ void device_remove_software_node(struct device *dev)
if (!swnode)
return;

- software_node_notify(dev, KOBJ_REMOVE);
+ if (device_is_registered(dev))
+ software_node_notify(dev, KOBJ_REMOVE);
set_secondary_fwnode(dev, NULL);
kobject_put(&swnode->kobj);
}
@@ -1119,8 +1128,7 @@ int software_node_notify(struct device *dev, unsigned long action)

switch (action) {
case KOBJ_ADD:
- ret = sysfs_create_link_nowarn(&dev->kobj, &swnode->kobj,
- "software_node");
+ ret = sysfs_create_link(&dev->kobj, &swnode->kobj, "software_node");
if (ret)
break;

--
2.30.2

2021-06-23 17:29:06

by Rafael J. Wysocki

Subject: Re: [PATCH] software node: Handle software node injection to an existing device properly

On Wed, Jun 23, 2021 at 3:14 PM Heikki Krogerus
<[email protected]> wrote:
>
> The function software_node_notify() - the function that creates
> and removes the symlinks between the node and the device - was
> called unconditionally in device_add_software_node() and
> device_remove_software_node(), but it needs to be called in
> those functions only in the special case where the node is
> added to a device that has already been registered.
>
> This fixes NULL pointer dereference that happens if
> device_remove_software_node() is used with device that was
> never registered.
>
> Fixes: b622b24519f5 ("software node: Allow node addition to already existing device")
> Reported-and-tested-by: Dominik Brodowski <[email protected]>
> Reviewed-by: Andy Shevchenko <[email protected]>
> Signed-off-by: Heikki Krogerus <[email protected]>

Applied, thanks!

It may not make it into 5.13 though due to the timing.

> ---
> drivers/base/swnode.c | 16 ++++++++++++----
> 1 file changed, 12 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
> index 3cc11b813f28c..d1f1a82401207 100644
> --- a/drivers/base/swnode.c
> +++ b/drivers/base/swnode.c
> @@ -1045,7 +1045,15 @@ int device_add_software_node(struct device *dev, const struct software_node *nod
> }
>
> set_secondary_fwnode(dev, &swnode->fwnode);
> - software_node_notify(dev, KOBJ_ADD);
> +
> + /*
> + * If the device has been fully registered by the time this function is
> + * called, software_node_notify() must be called separately so that the
> + * symlinks get created and the reference count of the node is kept in
> + * balance.
> + */
> + if (device_is_registered(dev))
> + software_node_notify(dev, KOBJ_ADD);
>
> return 0;
> }
> @@ -1065,7 +1073,8 @@ void device_remove_software_node(struct device *dev)
> if (!swnode)
> return;
>
> - software_node_notify(dev, KOBJ_REMOVE);
> + if (device_is_registered(dev))
> + software_node_notify(dev, KOBJ_REMOVE);
> set_secondary_fwnode(dev, NULL);
> kobject_put(&swnode->kobj);
> }
> @@ -1119,8 +1128,7 @@ int software_node_notify(struct device *dev, unsigned long action)
>
> switch (action) {
> case KOBJ_ADD:
> - ret = sysfs_create_link_nowarn(&dev->kobj, &swnode->kobj,
> - "software_node");
> + ret = sysfs_create_link(&dev->kobj, &swnode->kobj, "software_node");
> if (ret)
> break;
>
> --
> 2.30.2
>