All of lore.kernel.org
 help / color / mirror / Atom feed
From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
To: Hans de Goede <hdegoede@redhat.com>
Cc: Andy Shevchenko <andy.shevchenko@gmail.com>,
	linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org,
	platform-driver-x86@vger.kernel.org
Subject: [PATCH 02/12] software node: Increment parent node's ref count
Date: Fri, 15 Mar 2019 19:57:50 +0300	[thread overview]
Message-ID: <20190315165800.5058-3-heikki.krogerus@linux.intel.com> (raw)
In-Reply-To: <20190315165800.5058-1-heikki.krogerus@linux.intel.com>

If the parent node is removed before its children, release()
may be called first for the parent instead of the last child
when the child's ref count reaches zero. Since the nodes
release their parent's resources in the release callback,
that would cause NULL pointer dereference to happen. To
prevent that from ever happening, incrementing the parent
node's reference count when creating a new child node and
decrementing it when the child node is "released".

Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
---
 drivers/base/swnode.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
index 3a50a8edd3d3..8d4485d8d0f8 100644
--- a/drivers/base/swnode.c
+++ b/drivers/base/swnode.c
@@ -560,6 +560,7 @@ static void software_node_release(struct kobject *kobj)
 	if (swnode->parent) {
 		ida_simple_remove(&swnode->parent->child_ids, swnode->id);
 		list_del(&swnode->entry);
+		kobject_put(&swnode->parent->kobj);
 	} else {
 		ida_simple_remove(&swnode_root_ids, swnode->id);
 	}
@@ -610,8 +611,10 @@ fwnode_create_software_node(const struct property_entry *properties,
 	INIT_LIST_HEAD(&swnode->children);
 	swnode->parent = p;
 
-	if (p)
+	if (p) {
+		kobject_get(&p->kobj);
 		list_add_tail(&swnode->entry, &p->children);
+	}
 
 	ret = kobject_init_and_add(&swnode->kobj, &software_node_type,
 				   p ? &p->kobj : NULL, "node%d", swnode->id);
-- 
2.20.1


WARNING: multiple messages have this Message-ID (diff)
From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
To: Hans de Goede <hdegoede@redhat.com>
Cc: Andy Shevchenko <andy.shevchenko@gmail.com>,
	linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org,
	platform-driver-x86@vger.kernel.org
Subject: [02/12] software node: Increment parent node's ref count
Date: Fri, 15 Mar 2019 19:57:50 +0300	[thread overview]
Message-ID: <20190315165800.5058-3-heikki.krogerus@linux.intel.com> (raw)

If the parent node is removed before its children, release()
may be called first for the parent instead of the last child
when the child's ref count reaches zero. Since the nodes
release their parent's resources in the release callback,
that would cause NULL pointer dereference to happen. To
prevent that from ever happening, incrementing the parent
node's reference count when creating a new child node and
decrementing it when the child node is "released".

Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
---
 drivers/base/swnode.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
index 3a50a8edd3d3..8d4485d8d0f8 100644
--- a/drivers/base/swnode.c
+++ b/drivers/base/swnode.c
@@ -560,6 +560,7 @@ static void software_node_release(struct kobject *kobj)
 	if (swnode->parent) {
 		ida_simple_remove(&swnode->parent->child_ids, swnode->id);
 		list_del(&swnode->entry);
+		kobject_put(&swnode->parent->kobj);
 	} else {
 		ida_simple_remove(&swnode_root_ids, swnode->id);
 	}
@@ -610,8 +611,10 @@ fwnode_create_software_node(const struct property_entry *properties,
 	INIT_LIST_HEAD(&swnode->children);
 	swnode->parent = p;
 
-	if (p)
+	if (p) {
+		kobject_get(&p->kobj);
 		list_add_tail(&swnode->entry, &p->children);
+	}
 
 	ret = kobject_init_and_add(&swnode->kobj, &software_node_type,
 				   p ? &p->kobj : NULL, "node%d", swnode->id);

  parent reply	other threads:[~2019-03-15 16:59 UTC|newest]

Thread overview: 31+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-03-15 16:57 [RFC PATCH 00/12] platform/x86: intel_cht_int33fe: Real DisplayPort reference Heikki Krogerus
2019-03-15 16:57 ` [PATCH 01/12] software node: Prevent potential NULL Pointer Dereference Heikki Krogerus
2019-03-15 16:57   ` [01/12] " Heikki Krogerus
2019-03-15 16:57 ` Heikki Krogerus [this message]
2019-03-15 16:57   ` [02/12] software node: Increment parent node's ref count Heikki Krogerus
2019-03-15 16:57 ` [PATCH 03/12] software node: Add support for references Heikki Krogerus
2019-03-15 16:57   ` [03/12] " Heikki Krogerus
2019-03-15 16:57 ` [PATCH 04/12] software node: Implement .get_reference_args fwnode operation Heikki Krogerus
2019-03-15 16:57   ` [04/12] " Heikki Krogerus
2019-03-15 16:57 ` [PATCH 05/12] ACPI / property: Don't limit named child node matching to data nodes Heikki Krogerus
2019-03-15 16:57   ` [05/12] " Heikki Krogerus
2019-03-15 16:57 ` [PATCH 06/12] device connection: Find connections also by checking the references Heikki Krogerus
2019-03-15 16:57   ` [06/12] " Heikki Krogerus
2019-03-15 16:57 ` [PATCH 07/12] platform/x86: intel_cht_int33fe: Provide software node for all components Heikki Krogerus
2019-03-15 16:57   ` [07/12] " Heikki Krogerus
2019-03-17 20:36   ` [PATCH 07/12] " Andy Shevchenko
2019-03-17 20:36     ` [07/12] " Andy Shevchenko
2019-03-18  9:10     ` [PATCH 07/12] " Heikki Krogerus
2019-03-18  9:10       ` [07/12] " Heikki Krogerus
2019-03-18  9:25     ` [PATCH 07/12] " Andy Shevchenko
2019-03-18  9:25       ` [07/12] " Andy Shevchenko
2019-03-15 16:57 ` [PATCH 08/12] platform/x86: intel_cht_int33fe: Provide fwnode for the USB connector Heikki Krogerus
2019-03-15 16:57   ` [08/12] " Heikki Krogerus
2019-03-15 16:57 ` [PATCH 09/12] platform/x86: intel_cht_int33fe: Link with external dependencies using fwnodes Heikki Krogerus
2019-03-15 16:57   ` [09/12] " Heikki Krogerus
2019-03-15 16:57 ` [PATCH 10/12] platform/x86: intel_cht_int33fe: Replacing the old connections with references Heikki Krogerus
2019-03-15 16:57   ` [10/12] " Heikki Krogerus
2019-03-15 16:57 ` [PATCH 11/12] drm: Add fwnode member to the struct drm_connector Heikki Krogerus
2019-03-15 16:57   ` [11/12] " Heikki Krogerus
2019-03-15 16:58 ` [PATCH 12/12] drm/i915: Associate the ACPI connector nodes with connector entries Heikki Krogerus
2019-03-15 16:58   ` [12/12] " Heikki Krogerus

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190315165800.5058-3-heikki.krogerus@linux.intel.com \
    --to=heikki.krogerus@linux.intel.com \
    --cc=andy.shevchenko@gmail.com \
    --cc=hdegoede@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=platform-driver-x86@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.