Received: by 2002:a05:7412:37c9:b0:e2:908c:2ebd with SMTP id jz9csp1668380rdb; Wed, 20 Sep 2023 16:27:38 -0700 (PDT) X-Google-Smtp-Source: AGHT+IHbLYMfCdDXeejIcPfmv/aE7SZ81sUjWgA6X54wP96t+TA1v8bIGZ+KbzQ5Rzwd0H+HvFoB X-Received: by 2002:a17:903:445:b0:1c0:b17a:7576 with SMTP id iw5-20020a170903044500b001c0b17a7576mr3063694plb.42.1695252458135; Wed, 20 Sep 2023 16:27:38 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1695252458; cv=none; d=google.com; s=arc-20160816; b=SyVwwsQTKskKm+B+3Rp6/PwbRrkd4YIjc0vmnS2DdD10ARqfsw+JLMrIKAbG95geTm 6q3aqKrt27h04AY2kCU96l39ga+mctzNo399UnDsmzesVmhD7kVMX1Pn+VyFkgStvC/J R2C6G4HOuzv2T6R9C5Xn8HwFDr7NHCRygwOWJ4DKcvrmqvSBeGbev/8bYLu1O4CvA+/B iD8Ev92+gkWXKptkbHW5r+dttBpV8UncJoEC4yqE7z7ZkHl35zASmI6E2+CSjeiBzdI7 nR06ws1AWlltu+fbbnTgOZflORhyPtJ4+59Vw65T11zo/Yn5RDZQYT/zEP4yrGYyE7s+ JVPQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-disposition:mime-version:message-id :subject:cc:to:from:date:dkim-signature; bh=B/lu8BcHJ/ysOPQIAbugBzzumndKD9GUIWEsPV6mHQU=; fh=KTa/jrp4NTSVA7nCpRztpMFgP0vdA4FueRYZjfd0Uzc=; b=p/NRozcFgesZTXsHlaBqJCQUWqy8yY0h4QLP9lczovp1cuhP/muHY0wrlsHdC7gTw6 8uCFoDh/4wf8MWeFxDGg/VPb1+namxZAZ3EwQXTGURhxpbldY5LGX25Y8U4UyGp2G74k TOy37mxynwkcBSgIffM7RG1I/VCDWODR4hujZ2nYHz+liLpESe+2qTNpRHTaxfre91wM BuKEScLmlMxQRQNyjX750iUdRRXHsUKKf56awmU3T8zdZiI6s4PRJ462lFTjFbLftyON wXgohjkOY7I+KfPaLwQPVXf8RbKnmjoyOW8DFrnhgkKwAZwqi0frtbVS/JCEmwaUtPVu lvbQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20230601 header.b=ATLStUVa; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:2 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from agentk.vger.email (agentk.vger.email. [2620:137:e000::3:2]) by mx.google.com with ESMTPS id kg5-20020a170903060500b001b973681493si135140plb.16.2023.09.20.16.27.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 20 Sep 2023 16:27:38 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:2 as permitted sender) client-ip=2620:137:e000::3:2; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20230601 header.b=ATLStUVa; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:2 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by agentk.vger.email (Postfix) with ESMTP id DF0AB81C36F9; Wed, 20 Sep 2023 11:09:36 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at agentk.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229669AbjITSJZ (ORCPT + 99 others); Wed, 20 Sep 2023 14:09:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56898 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229663AbjITSJT (ORCPT ); Wed, 20 Sep 2023 14:09:19 -0400 Received: from mail-pj1-x102a.google.com (mail-pj1-x102a.google.com [IPv6:2607:f8b0:4864:20::102a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 07DD2D6; Wed, 20 Sep 2023 11:09:14 -0700 (PDT) Received: by mail-pj1-x102a.google.com with SMTP id 98e67ed59e1d1-274b01849c4so11531a91.3; Wed, 20 Sep 2023 11:09:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1695233353; x=1695838153; darn=vger.kernel.org; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :from:to:cc:subject:date:message-id:reply-to; bh=B/lu8BcHJ/ysOPQIAbugBzzumndKD9GUIWEsPV6mHQU=; b=ATLStUVarJQARDf6LuL8kZwydKTbXAQ/6pcLEDT6yWMNTYVEZAbSuvl+NcGXPh/Vhp EmyweuFZXm9EC2M8uc/0aqzwLWxNL7UpgW/QgpgePqy+oHTtRIkn5+ZiPi0d9W0bkZ+m jQD/11Yv3UeXNmsy6gh332yjYvX8OSOjgEBDVqVvvWq9phGC1gtYsMSiEW441P9AW+/T g/twWg3sdks6xOMMMh8+HFdJPRMa3ptxor9mCfFTx0Pq8vwgKCVpg+zyfq4gZwO1olw0 prjXtJr5kVMMKeOevSLOQqOdz4cVQktcDk5J6oVmBAEzz3qQXMIW9h3imbl4hqkwazHJ IgxA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1695233353; x=1695838153; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=B/lu8BcHJ/ysOPQIAbugBzzumndKD9GUIWEsPV6mHQU=; b=CMnzmgpuJx1oX1LooHioviSyNvbWCwXVKQbcEf3VumK2LyaOWSgibbaDwYB4TEUFmH h+SDeQ8CFDUYg0116uVVYTmCjSmYLRftDjyAOM/3igtSlMzO+CBUjVUNtNie7DDYuupT IrkOyX1UIC3JeM/mR8tBbqjJ7pBMMIMoPbE2OKmlhPi8JKz/lEIO2jeEnN+DjxdTJwvL k0AyEiHJkSI0ARlMS8MYRYPAsyItLATnk28+uNu/u8jmDad6YIeqXSE1N3DtJT/7eonS TyBLgjFi2ev8EF+IiGM3nVuauizFQTu0A7s9S+l336cgvIUt0XQUXGQ9pkAf6HMSqPaD 9gKg== X-Gm-Message-State: AOJu0Ywjl5m5eQfrZsissj4JiRq+qbTwGdgD7cRl1LAs3s149UpYMdA+ JRvs4kWoeTn+5gM3SyZudCY= X-Received: by 2002:a17:90a:3ec6:b0:268:29cf:3231 with SMTP id k64-20020a17090a3ec600b0026829cf3231mr3278194pjc.3.1695233353165; Wed, 20 Sep 2023 11:09:13 -0700 (PDT) Received: from google.com ([2620:15c:9d:2:3073:3a17:4a3d:2738]) by smtp.gmail.com with ESMTPSA id v13-20020a17090ac90d00b002639c4f81cesm1632455pjt.3.2023.09.20.11.09.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 20 Sep 2023 11:09:12 -0700 (PDT) Date: Wed, 20 Sep 2023 11:09:10 -0700 From: Dmitry Torokhov To: Linus Walleij Cc: Bartosz Golaszewski , linux-gpio@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] pinctrl: avoid unsafe code pattern in find_pinctrl() Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Spam-Status: No, score=-0.6 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on agentk.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (agentk.vger.email [0.0.0.0]); Wed, 20 Sep 2023 11:09:37 -0700 (PDT) The code in find_pinctrl() takes a mutex and traverses a list of pinctrl structures. Later the caller bumps up reference count on the found structure. Such pattern is not safe as pinctrl that was found may get deleted before the caller gets around to increasing the reference count. Fix this by taking the reference count in find_pinctrl(), while it still holds the mutex. Signed-off-by: Dmitry Torokhov --- drivers/pinctrl/core.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c index e9dc9638120a..e2f7519bef04 100644 --- a/drivers/pinctrl/core.c +++ b/drivers/pinctrl/core.c @@ -1022,17 +1022,20 @@ static int add_setting(struct pinctrl *p, struct pinctrl_dev *pctldev, static struct pinctrl *find_pinctrl(struct device *dev) { - struct pinctrl *p; + struct pinctrl *entry, *p = NULL; mutex_lock(&pinctrl_list_mutex); - list_for_each_entry(p, &pinctrl_list, node) - if (p->dev == dev) { - mutex_unlock(&pinctrl_list_mutex); - return p; + + list_for_each_entry(entry, &pinctrl_list, node) { + if (entry->dev == dev) { + p = entry; + kref_get(&p->users); + break; } + } mutex_unlock(&pinctrl_list_mutex); - return NULL; + return p; } static void pinctrl_free(struct pinctrl *p, bool inlist); @@ -1140,7 +1143,6 @@ struct pinctrl *pinctrl_get(struct device *dev) p = find_pinctrl(dev); if (p) { dev_dbg(dev, "obtain a copy of previously claimed pinctrl\n"); - kref_get(&p->users); return p; } -- 2.42.0.515.g380fc7ccd1-goog -- Dmitry