[PATCH v3 01/15] iio: inkern: only release the device node when done with it

From: "Nuno Sá" <nuno.sa@analog.com>
To: <openbmc@lists.ozlabs.org>, <linux-imx@nxp.com>,
	<linux-stm32@st-md-mailman.stormreply.com>,
	<linux-iio@vger.kernel.org>, <linux-mips@vger.kernel.org>,
	<linux-renesas-soc@vger.kernel.org>,
	<linux-mediatek@lists.infradead.org>,
	<chrome-platform@lists.linux.dev>,
	<linux-arm-kernel@lists.infradead.org>,
	Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>,
	<linux-arm-msm@vger.kernel.org>
Cc: Gwendal Grignou <gwendal@chromium.org>,
	Jonathan Cameron <jic23@kernel.org>,
	Saravanan Sekar <sravanhome@gmail.com>,
	Tomer Maimon <tmaimon77@gmail.com>,
	Maxime Coquelin <mcoquelin.stm32@gmail.com>,
	Alexandre Torgue <alexandre.torgue@foss.st.com>,
	Lorenzo Bianconi <lorenzo@kernel.org>,
	Fabio Estevam <festevam@gmail.com>,
	Shawn Guo <shawnguo@kernel.org>,
	Olivier Moysan <olivier.moysan@foss.st.com>,
	Tali Perry <tali.perry1@gmail.com>,
	Thara Gopinath <thara.gopinath@linaro.org>,
	Bjorn Andersson <bjorn.andersson@linaro.org>,
	Arnd Bergmann <arnd@arndb.de>,
	Benjamin Fair <benjaminfair@google.com>,
	Nicolas Ferre <nicolas.ferre@microchip.com>,
	"Rafael J. Wysocki" <rafael@kernel.org>,
	Patrick Venture <venture@google.com>,
	Pengutronix Kernel Team <kernel@pengutronix.de>,
	Fabrice Gasnier <fabrice.gasnier@foss.st.com>,
	Daniel Lezcano <daniel.lezcano@linaro.org>,
	Benson Leung <bleung@chromium.org>, Nancy Yuen <yuenn@google.com>,
	Miquel Raynal <miquel.raynal@bootlin.com>,
	Alexandre Belloni <alexandre.belloni@bootlin.com>,
	Zhang Rui <rui.zhang@intel.com>,
	Linus Walleij <linus.walleij@linaro.org>,
	Christophe Branchereau <cbranchereau@gmail.com>,
	Cai Huoqing <cai.huoqing@linux.dev>,
	Avi Fishman <avifishman70@gmail.com>,
	Eugen Hristev <eugen.hristev@microchip.com>,
	Matthias Brugger <matthias.bgg@gmail.com>,
	Sascha Hauer <s.hauer@pengutronix.de>,
	Lars-Peter Clausen <lars@metafoo.de>,
	Andy Shevchenko <andy.shevchenko@gmail.com>,
	Guenter Roeck <groeck@chromium.org>,
	Paul Cercueil <paul@crapouillou.net>,
	Claudiu Beznea <claudiu.beznea@microchip.com>,
	Andy Gross <agross@kernel.org>, Amit Kucheria <amitk@kernel.org>,
	Michael Hennerich <Michael.Hennerich@analog.com>,
	Haibo Chen <haibo.chen@nxp.com>,
	Jishnu Prakash <quic_jprakash@quicinc.com>
Subject: [PATCH v3 01/15] iio: inkern: only release the device node when done with it
Date: Fri, 15 Jul 2022 14:28:49 +0200	[thread overview]
Message-ID: <20220715122903.332535-2-nuno.sa@analog.com> (raw)
In-Reply-To: <20220715122903.332535-1-nuno.sa@analog.com>

'of_node_put()' can potentially release the memory pointed to by
'iiospec.np' which would leave us with an invalid pointer (and we would
still pass it in 'of_xlate()'). Note that it is not guaranteed for the
of_node lifespan to be attached to the device (to which is attached)
lifespan so that there is (even though very unlikely) the possibility
for the node to be freed while the device is still around. Thus, as there
are indeed some of_xlate users which do access the node, a race is indeed
possible.

As such, we can only release the node after we are done with it.

Fixes: 17d82b47a215d ("iio: Add OF support")
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
---
 drivers/iio/inkern.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
index df74765d33dc..9d87057794fc 100644
--- a/drivers/iio/inkern.c
+++ b/drivers/iio/inkern.c
@@ -165,9 +165,10 @@ static int __of_iio_channel_get(struct iio_channel *channel,
 
 	idev = bus_find_device(&iio_bus_type, NULL, iiospec.np,
 			       iio_dev_node_match);
-	of_node_put(iiospec.np);
-	if (idev == NULL)
+	if (idev == NULL) {
+		of_node_put(iiospec.np);
 		return -EPROBE_DEFER;
+	}
 
 	indio_dev = dev_to_iio_dev(idev);
 	channel->indio_dev = indio_dev;
@@ -175,6 +176,7 @@ static int __of_iio_channel_get(struct iio_channel *channel,
 		index = indio_dev->info->of_xlate(indio_dev, &iiospec);
 	else
 		index = __of_iio_simple_xlate(indio_dev, &iiospec);
+	of_node_put(iiospec.np);
 	if (index < 0)
 		goto err_put;
 	channel->channel = &indio_dev->channels[index];
-- 
2.37.1

