PCI: keystone: fix interrupt-controller-node lookup

PATCH Applied Johan Hovold 3 participants 7 messages Nov 17, 2017 – Dec 15, 2017

Subsystems (2)

Stable branch PCI

lore

Share & tools

lore

Johan Hovold

author

2017-11-17 13:38 UTC #0 lore raw

PATCH v2 1/1 PCI: keystone: fix interrupt-controller-node lookup

Fix child-node lookup during initialisation which was using the wrong OF-helper and ended up searching the whole device tree depth-first starting at the parent rather than just matching on its children.

To make things worse, the parent pci node could end up being prematurely freed as of_find_node_by_name() drops a reference to its first argument. Any matching child interrupt-controller node was also leaked.

Fixes 0c4ffcfe1fbc ("PCI: keystone: Add TI Keystone PCIe driver")

Cc stable <[email protected]> # 3.18

Acked-by Murali Karicheri <[email protected]>

Acked-by Lorenzo Pieralisi <[email protected]>

Signed-off-by Johan Hovold <[email protected]>

---

v2
- amend commit message and mention explicitly that of_find_node_by_name() drops a reference to the start node
- add Murali's and Lorenzo's acks

 drivers/pci/dwc/pci-keystone.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

drivers/pci/dwc/pci-keystone.c +4 -1

index 5bee3af47588..39405598b22d 100644
@@ -178,7 +178,7 @@ static int ks_pcie_get_irq_controller_info(struct keystone_pcie *ks_pcie,
 	}
 
 	/* interrupt controller is in a child node */
-	*np_temp = of_find_node_by_name(np_pcie, controller);
+	*np_temp = of_get_child_by_name(np_pcie, controller);
 	if (!(*np_temp)) {
 		dev_err(dev, "Node for %s is absent\n", controller);
 		return -EINVAL;

@@ -187,6 +187,7 @@ static int ks_pcie_get_irq_controller_info(struct keystone_pcie *ks_pcie,
 	temp = of_irq_count(*np_temp);
 	if (!temp) {
 		dev_err(dev, "No IRQ entries in %s\n", controller);
+		of_node_put(*np_temp);
 		return -EINVAL;
 	}

@@ -204,6 +205,8 @@ static int ks_pcie_get_irq_controller_info(struct keystone_pcie *ks_pcie,
 			break;
 	}
 
+	of_node_put(*np_temp);
+
 	if (temp) {
 		*num_irqs = temp;
 		return 0;

Signature · 1 line

2.15.0

Johan Hovold

author

2017-12-11 10:29 UTC #1 lore raw

Quoted 13 lines · Johan Hovold

Fix child-node lookup during initialisation which was using the wrong OF-helper and ended up searching the whole device tree depth-first starting at the parent rather than just matching on its children.
To make things worse, the parent pci node could end up being prematurely freed as of_find_node_by_name() drops a reference to its first argument. Any matching child interrupt-controller node was also leaked.
Fixes 0c4ffcfe1fbc ("PCI: keystone: Add TI Keystone PCIe driver")
Cc stable <[email protected]> # 3.18
Acked-by Murali Karicheri <[email protected]>
Acked-by Lorenzo Pieralisi <[email protected]>
Signed-off-by Johan Hovold <[email protected]>

Quoted 6 lines

---
v2
- amend commit message and mention explicitly that of_find_node_by_name() drops a reference to the start node
- add Murali's and Lorenzo's acks

This one hasn't shown up in linux-next, so sending a reminder to make sure it doesn't fall between the cracks.

Thanks,
Johan

Lorenzo Pieralisi

2017-12-11 10:41 UTC #2 lore raw

Quoted 16 lines · Johan Hovold

Quoted 15 lines · Johan Hovold
Fix child-node lookup during initialisation which was using the wrong OF-helper and ended up searching the whole device tree depth-first starting at the parent rather than just matching on its children.
To make things worse, the parent pci node could end up being prematurely freed as of_find_node_by_name() drops a reference to its first argument. Any matching child interrupt-controller node was also leaked.
Fixes 0c4ffcfe1fbc ("PCI: keystone: Add TI Keystone PCIe driver")
Cc stable <[email protected]> # 3.18
Acked-by Murali Karicheri <[email protected]>
Acked-by Lorenzo Pieralisi <[email protected]>
Signed-off-by Johan Hovold <[email protected]>
---

Quoted 7 lines

Quoted 4 lines
v2
- amend commit message and mention explicitly that of_find_node_by_name() drops a reference to the start node
- add Murali's and Lorenzo's acks
This one hasn't shown up in linux-next, so sending a reminder to make sure it doesn't fall between the cracks.

Hi Johan,

yes it is in the list of fixes to be sent upstream - I was about to ask Bjorn to apply it.

Thanks,
Lorenzo

Bjorn Helgaas

2017-12-12 17:25 UTC #3 lore raw

Quoted 22 lines · Lorenzo Pieralisi

Quoted 21 lines · Johan Hovold
Quoted 19 lines · Johan Hovold
Fix child-node lookup during initialisation which was using the wrong OF-helper and ended up searching the whole device tree depth-first starting at the parent rather than just matching on its children.
To make things worse, the parent pci node could end up being prematurely freed as of_find_node_by_name() drops a reference to its first argument. Any matching child interrupt-controller node was also leaked.
Fixes 0c4ffcfe1fbc ("PCI: keystone: Add TI Keystone PCIe driver")
Cc stable <[email protected]> # 3.18
Acked-by Murali Karicheri <[email protected]>
Acked-by Lorenzo Pieralisi <[email protected]>
Signed-off-by Johan Hovold <[email protected]>
---
v2
- amend commit message and mention explicitly that of_find_node_by_name() drops a reference to the start node
- add Murali's and Lorenzo's acks

Quoted 7 lines

Quoted 2 lines
This one hasn't shown up in linux-next, so sending a reminder to make sure it doesn't fall between the cracks.
Hi Johan,
yes it is in the list of fixes to be sent upstream - I was about to ask Bjorn to apply it.

Is this something that needs to be merged for v4.15? If so, I need to be able to defend it to Linus as being a critical fix. If the issue been around for 3 years (v3.18 was tagged Dec 7 2014), that requires pretty "clear and present danger."

Quoted 1 line

From the commit log, I see a sub-optimal search (not critical), a

possible use-after-free (could conceivably be critical if people are tripping over this, but would need more specifics about that), and a leak (not critical).

Given what I can see now, my inclination would be for Lorenzo to queue it for v4.16, which would still get in linux-next soonish.

Bjorn

Lorenzo Pieralisi

2017-12-12 18:06 UTC #4 lore raw

Quoted 36 lines · Bjorn Helgaas

Quoted 22 lines · Lorenzo Pieralisi
Quoted 21 lines · Johan Hovold
Quoted 19 lines · Johan Hovold
Fix child-node lookup during initialisation which was using the wrong OF-helper and ended up searching the whole device tree depth-first starting at the parent rather than just matching on its children.
To make things worse, the parent pci node could end up being prematurely freed as of_find_node_by_name() drops a reference to its first argument. Any matching child interrupt-controller node was also leaked.
Fixes 0c4ffcfe1fbc ("PCI: keystone: Add TI Keystone PCIe driver")
Cc stable <[email protected]> # 3.18
Acked-by Murali Karicheri <[email protected]>
Acked-by Lorenzo Pieralisi <[email protected]>
Signed-off-by Johan Hovold <[email protected]>
---
v2
- amend commit message and mention explicitly that of_find_node_by_name() drops a reference to the start node
- add Murali's and Lorenzo's acks
Quoted 7 lines
Quoted 2 lines
This one hasn't shown up in linux-next, so sending a reminder to make sure it doesn't fall between the cracks.
Hi Johan,
yes it is in the list of fixes to be sent upstream - I was about to ask Bjorn to apply it.
Is this something that needs to be merged for v4.15? If so, I need to be able to defend it to Linus as being a critical fix. If the issue been around for 3 years (v3.18 was tagged Dec 7 2014), that requires pretty "clear and present danger."

Quoted 7 lines

From the commit log, I see a sub-optimal search (not critical), a possible use-after-free (could conceivably be critical if people are tripping over this, but would need more specifics about that), and a leak (not critical).
Given what I can see now, my inclination would be for Lorenzo to queue it for v4.16, which would still get in linux-next soonish.

It is fine by me and I think, as already mentioned, that the stable tag is dubious so I will probably drop it.

Lorenzo

Johan Hovold

author

2017-12-12 19:29 UTC #5 lore raw

Quoted 42 lines · Lorenzo Pieralisi

Quoted 41 lines · Bjorn Helgaas
Quoted 22 lines · Lorenzo Pieralisi
Quoted 21 lines · Johan Hovold
Quoted 19 lines · Johan Hovold
Fix child-node lookup during initialisation which was using the wrong OF-helper and ended up searching the whole device tree depth-first starting at the parent rather than just matching on its children.
To make things worse, the parent pci node could end up being prematurely freed as of_find_node_by_name() drops a reference to its first argument. Any matching child interrupt-controller node was also leaked.
Fixes 0c4ffcfe1fbc ("PCI: keystone: Add TI Keystone PCIe driver")
Cc stable <[email protected]> # 3.18
Acked-by Murali Karicheri <[email protected]>
Acked-by Lorenzo Pieralisi <[email protected]>
Signed-off-by Johan Hovold <[email protected]>
---
v2
- amend commit message and mention explicitly that of_find_node_by_name() drops a reference to the start node
- add Murali's and Lorenzo's acks
Quoted 7 lines
Quoted 2 lines
This one hasn't shown up in linux-next, so sending a reminder to make sure it doesn't fall between the cracks.
Hi Johan,
yes it is in the list of fixes to be sent upstream - I was about to ask Bjorn to apply it.
Is this something that needs to be merged for v4.15? If so, I need to be able to defend it to Linus as being a critical fix. If the issue been around for 3 years (v3.18 was tagged Dec 7 2014), that requires pretty "clear and present danger."
From the commit log, I see a sub-optimal search (not critical), a possible use-after-free (could conceivably be critical if people are tripping over this, but would need more specifics about that), and a leak (not critical).

Quoted 5 lines

Quoted 2 lines
Given what I can see now, my inclination would be for Lorenzo to queue it for v4.16, which would still get in linux-next soonish.
It is fine by me and I think, as already mentioned, that the stable tag is dubious so I will probably drop it.

The unbalanced put can indeed cause serious problems, for example, after probe deferrals. Crashes after probe deferrals has been reported for other drivers with the same type of bug, and I have reproduced it locally (using yet another driver).

I'm also fine with holding this one off for 4.16 (as we're at -rc3), but I do think the stable tag is still warranted.

Johan

Lorenzo Pieralisi

Applied

2017-12-15 13:22 UTC #6 lore raw

In reply to Johan Hovold

Quoted 8 lines · Johan Hovold

Fix child-node lookup during initialisation which was using the wrong OF-helper and ended up searching the whole device tree depth-first starting at the parent rather than just matching on its children.
To make things worse, the parent pci node could end up being prematurely freed as of_find_node_by_name() drops a reference to its first argument. Any matching child interrupt-controller node was also leaked.

Quoted 6 lines

Fixes 0c4ffcfe1fbc ("PCI: keystone: Add TI Keystone PCIe driver")
Cc stable <[email protected]> # 3.18
Acked-by Murali Karicheri <[email protected]>
Acked-by Lorenzo Pieralisi <[email protected]>
Signed-off-by Johan Hovold <[email protected]>
---

Applied to pci/keystone for v4.16.

Thanks,
Lorenzo

Quoted 42 lines

v2
- amend commit message and mention explicitly that of_find_node_by_name() drops a reference to the start node
- add Murali's and Lorenzo's acks

 drivers/pci/dwc/pci-keystone.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

drivers/pci/dwc/pci-keystone.c +4 -1

index 5bee3af47588..39405598b22d 100644
@@ -178,7 +178,7 @@ static int ks_pcie_get_irq_controller_info(struct keystone_pcie *ks_pcie,
 	}
 
 	/* interrupt controller is in a child node */
-	*np_temp = of_find_node_by_name(np_pcie, controller);
+	*np_temp = of_get_child_by_name(np_pcie, controller);
 	if (!(*np_temp)) {
 		dev_err(dev, "Node for %s is absent\n", controller);
 		return -EINVAL;

@@ -187,6 +187,7 @@ static int ks_pcie_get_irq_controller_info(struct keystone_pcie *ks_pcie,
 	temp = of_irq_count(*np_temp);
 	if (!temp) {
 		dev_err(dev, "No IRQ entries in %s\n", controller);
+		of_node_put(*np_temp);
 		return -EINVAL;
 	}

@@ -204,6 +205,8 @@ static int ks_pcie_get_irq_controller_info(struct keystone_pcie *ks_pcie,
 			break;
 	}
 
+	of_node_put(*np_temp);
+
 	if (temp) {
 		*num_irqs = temp;
 		return 0;

Signature · 1 line

2.15.0