Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 28 Oct 2022 18:58:47 +0200
From:   Luca Ceresoli <luca.ceresoli@bootlin.com>
To:     Dan Carpenter <dan.carpenter@oracle.com>
Cc:     Thierry Reding <thierry.reding@gmail.com>,
        Jonathan Hunter <jonathanh@nvidia.com>,
        Sowjanya Komatineni <skomatineni@nvidia.com>,
        Mauro Carvalho Chehab <mchehab@kernel.org>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Hans Verkuil <hverkuil-cisco@xs4all.nl>,
        Thomas Petazzoni <thomas.petazzoni@bootlin.com>,
        stable@vger.kernel.org,
        Mauro Carvalho Chehab <mchehab+huawei@kernel.org>,
        linux-media@vger.kernel.org, linux-tegra@vger.kernel.org,
        linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] staging: media: tegra-video: fix device_node use after
 free
Message-ID: <20221028185847.5454a98d@booty>
In-Reply-To: <Y1vMX/Zciz/XQ+4p@kadam>
References: <20221028081926.2320663-1-luca.ceresoli@bootlin.com>
        <Y1vMX/Zciz/XQ+4p@kadam>
Organization: Bootlin
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Precedence: bulk

Hello Dan,

On Fri, 28 Oct 2022 15:34:39 +0300
Dan Carpenter <dan.carpenter@oracle.com> wrote:

> On Fri, Oct 28, 2022 at 10:19:26AM +0200, luca.ceresoli@bootlin.com wrote:
> > From: Luca Ceresoli <luca.ceresoli@bootlin.com>
> > 
> > At probe time this code path is followed:
> > 
> >  * tegra_csi_init
> >    * tegra_csi_channels_alloc
> >      * for_each_child_of_node(node, channel) -- iterates over channels
> >        * automatically gets 'channel'
> >          * tegra_csi_channel_alloc()
> >            * saves into chan->of_node a pointer to the channel OF node
> >        * automatically gets and puts 'channel'
> >        * now the node saved in chan->of_node has refcount 0, can disappear
> >    * tegra_csi_channels_init
> >      * iterates over channels
> >        * tegra_csi_channel_init -- uses chan->of_node
> > 
> > After that, chan->of_node keeps storing the node until the device is
> > removed.
> > 
> > of_node_get() the node and of_node_put() it during teardown to avoid any
> > risk.
> > 
> > Fixes: 1ebaeb09830f ("media: tegra-video: Add support for external sensor capture")
> > Cc: stable@vger.kernel.org
> > Cc: Sowjanya Komatineni <skomatineni@nvidia.com>
> > Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
> > ---
> >  drivers/staging/media/tegra-video/csi.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/staging/media/tegra-video/csi.c b/drivers/staging/media/tegra-video/csi.c
> > index b26e44adb2be..1b05f620b476 100644
> > --- a/drivers/staging/media/tegra-video/csi.c
> > +++ b/drivers/staging/media/tegra-video/csi.c
> > @@ -433,7 +433,7 @@ static int tegra_csi_channel_alloc(struct tegra_csi *csi,
> >  	for (i = 0; i < chan->numgangports; i++)
> >  		chan->csi_port_nums[i] = port_num + i * CSI_PORTS_PER_BRICK;
> >  
> > -	chan->of_node = node;
> > +	chan->of_node = of_node_get(node);
> >  	chan->numpads = num_pads;
> >  	if (num_pads & 0x2) {
> >  		chan->pads[0].flags = MEDIA_PAD_FL_SINK;
> > @@ -640,6 +640,7 @@ static void tegra_csi_channels_cleanup(struct tegra_csi *csi)
> >  			media_entity_cleanup(&subdev->entity);
> >  		}
> >  
> > +		of_node_put(chan->of_node);
> >  		list_del(&chan->list);
> >  		kfree(chan);  
> 
> Not related to your patch, but this kind of "one function cleans up
> everything" style is always buggy.  For example, here it should be:
> 
> -		if (chan->mipi)
> +		if (!IS_ERR_OR_NULL(chan->mipi))
> 			tegra_mipi_free(chan->mipi);

I sort of agree the code could be clearer here, but looking at the code
in detail, this cannot happen. chan->mipi is set in one place only, and
if it is an error the whole probe fails. So it can be either NULL or a
valid pointer here.

Regarding my patch, do you think it is valid?

Best regards.
-- 
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com