From: Rob Herring <robh+dt@kernel.org>
To: Frank Rowand <frowand.list@gmail.com>
Cc: mwb@linux.vnet.ibm.com,
linuxppc-dev <linuxppc-dev@lists.ozlabs.org>,
Michael Ellerman <mpe@ellerman.id.au>,
Tyrel Datwyler <tyreld@linux.vnet.ibm.com>,
tlfalcon@linux.vnet.ibm.com, minkim@us.ibm.com,
devicetree@vger.kernel.org,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH 1/2] of: of_node_get()/of_node_put() nodes held in phandle cache
Date: Fri, 14 Dec 2018 11:15:36 -0600 [thread overview]
Message-ID: <CAL_JsqKn8RpRmk7OQB9nEM6nZMfdyjgomqMqLU=u+q2qUzQQCg@mail.gmail.com> (raw)
In-Reply-To: <1544769771-5468-2-git-send-email-frowand.list@gmail.com>
On Fri, Dec 14, 2018 at 12:43 AM <frowand.list@gmail.com> wrote:
>
> From: Frank Rowand <frank.rowand@sony.com>
>
> The phandle cache contains struct device_node pointers. The refcount
> of the pointers was not incremented while in the cache, allowing use
> after free error after kfree() of the node. Add the proper increment
> and decrement of the use count.
Since we pre-populate the cache at boot, all the nodes will have a ref
count and will never be freed unless we happen to repopulate the whole
cache. That doesn't seem ideal. The node pointer is not "in use" just
because it is in the cache.
Rob
next prev parent reply other threads:[~2018-12-14 17:15 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-14 6:42 [PATCH 0/2] of: phandle_cache, fix refcounts, remove stale entry frowand.list
2018-12-14 6:42 ` [PATCH 1/2] of: of_node_get()/of_node_put() nodes held in phandle cache frowand.list
2018-12-14 17:15 ` Rob Herring [this message]
2018-12-14 22:47 ` Frank Rowand
2018-12-14 23:04 ` Frank Rowand
2018-12-14 6:42 ` [PATCH 2/2] of: __of_detach_node() - remove node from " frowand.list
2018-12-14 17:20 ` Rob Herring
2018-12-14 21:56 ` Michael Bringmann
2018-12-14 22:38 ` Frank Rowand
2018-12-14 6:46 ` [PATCH 0/2] of: phandle_cache, fix refcounts, remove stale entry Frank Rowand
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAL_JsqKn8RpRmk7OQB9nEM6nZMfdyjgomqMqLU=u+q2qUzQQCg@mail.gmail.com' \
--to=robh+dt@kernel.org \
--cc=devicetree@vger.kernel.org \
--cc=frowand.list@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=minkim@us.ibm.com \
--cc=mpe@ellerman.id.au \
--cc=mwb@linux.vnet.ibm.com \
--cc=tlfalcon@linux.vnet.ibm.com \
--cc=tyreld@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).