All of lore.kernel.org
 help / color / mirror / Atom feed
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
To: Linus Walleij <linus.walleij@linaro.org>
Cc: netdev@vger.kernel.org, "David S . Miller" <davem@davemloft.net>,
	linux-kernel@vger.kernel.org, Andrew Lunn <andrew@lunn.ch>,
	Florian Fainelli <f.fainelli@gmail.com>,
	Heiner Kallweit <hkallweit1@gmail.com>
Subject: [PATCH v2 2/3] net: phy: fixed_phy: fix use-after-free when checking link GPIO
Date: Mon, 14 Oct 2019 10:40:21 -0700	[thread overview]
Message-ID: <20191014174022.94605-3-dmitry.torokhov@gmail.com> (raw)
In-Reply-To: <20191014174022.94605-1-dmitry.torokhov@gmail.com>

If we fail to locate GPIO for any reason other than deferral or
not-found-GPIO, we try to print device tree node info, however if might
be freed already as we called of_node_put() on it.

Acked-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---

 drivers/net/phy/fixed_phy.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c
index 7c5265fd2b94..4190f9ed5313 100644
--- a/drivers/net/phy/fixed_phy.c
+++ b/drivers/net/phy/fixed_phy.c
@@ -212,16 +212,13 @@ static struct gpio_desc *fixed_phy_get_gpiod(struct device_node *np)
 	 */
 	gpiod = gpiod_get_from_of_node(fixed_link_node, "link-gpios", 0,
 				       GPIOD_IN, "mdio");
-	of_node_put(fixed_link_node);
-	if (IS_ERR(gpiod)) {
-		if (PTR_ERR(gpiod) == -EPROBE_DEFER)
-			return gpiod;
-
+	if (IS_ERR(gpiod) && PTR_ERR(gpiod) != -EPROBE_DEFER) {
 		if (PTR_ERR(gpiod) != -ENOENT)
 			pr_err("error getting GPIO for fixed link %pOF, proceed without\n",
 			       fixed_link_node);
 		gpiod = NULL;
 	}
+	of_node_put(fixed_link_node);
 
 	return gpiod;
 }
-- 
2.23.0.700.g56cf767bdb-goog


  parent reply	other threads:[~2019-10-14 17:40 UTC|newest]

Thread overview: 19+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-10-14 17:40 [PATCH v2 0/3] net: phy: switch to using fwnode_gpiod_get_index Dmitry Torokhov
2019-10-14 17:40 ` [PATCH v2 1/3] net: phylink: switch to using fwnode_gpiod_get_index() Dmitry Torokhov
2019-10-14 17:55   ` Russell King - ARM Linux admin
2019-10-14 20:30   ` kbuild test robot
2019-10-14 20:30     ` kbuild test robot
2019-10-15 13:02   ` kbuild test robot
2019-10-15 13:02     ` kbuild test robot
2019-10-14 17:40 ` Dmitry Torokhov [this message]
2019-10-15 12:54   ` [PATCH v2 2/3] net: phy: fixed_phy: fix use-after-free when checking link GPIO Andrew Lunn
2019-10-14 17:40 ` [PATCH v2 3/3] net: phy: fixed_phy: switch to using fwnode_gpiod_get_index Dmitry Torokhov
2019-10-14 22:37   ` kbuild test robot
2019-10-14 22:37     ` kbuild test robot
2019-10-16  3:18 ` [PATCH v2 0/3] net: phy: " David Miller
2019-11-05  0:40 ` Dmitry Torokhov
2019-11-05  0:55   ` Russell King - ARM Linux admin
2019-11-05 17:27     ` Dmitry Torokhov
2019-11-05 18:04       ` David Miller
2019-11-05 18:20         ` Dmitry Torokhov
2019-11-13 21:26           ` Dmitry Torokhov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20191014174022.94605-3-dmitry.torokhov@gmail.com \
    --to=dmitry.torokhov@gmail.com \
    --cc=andrew@lunn.ch \
    --cc=davem@davemloft.net \
    --cc=f.fainelli@gmail.com \
    --cc=hkallweit1@gmail.com \
    --cc=linus.walleij@linaro.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.