On 17/12/2024 10:14, Joe Hattori wrote:
> As of_find_node_by_name() release the reference of the given OF node,
No, it does not.
> tegra_emc_find_node_by_ram_code() releases some OF nodes while still in
> use, resulting in possible UAFs. Given the DT structure, utilize the
> for_each_child_of_node macro and of_get_child_by_name() to avoid the bug.
>
> This bug was found by an experimental verification tool that I am
> developing.
>
> Fixes: 96e5da7c8424 ("memory: tegra: Introduce Tegra20 EMC driver")
> Signed-off-by: Joe Hattori <joe@xxxxxxxxxxxxxxxxxxxxx>
> ---
> drivers/memory/tegra/tegra20-emc.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/memory/tegra/tegra20-emc.c b/drivers/memory/tegra/tegra20-emc.c
> index 7193f848d17e..9b7d30a21a5b 100644
> --- a/drivers/memory/tegra/tegra20-emc.c
> +++ b/drivers/memory/tegra/tegra20-emc.c
> @@ -474,14 +474,15 @@ tegra_emc_find_node_by_ram_code(struct tegra_emc *emc)
>
> ram_code = tegra_read_ram_code();
>
> - for (np = of_find_node_by_name(dev->of_node, "emc-tables"); np;
> - np = of_find_node_by_name(np, "emc-tables")) {
> + for_each_child_of_node(dev->of_node, np) {
I don't understand how this change is related to described problem.
> + if (!of_node_name_eq(np, "emc-tables"))
> + continue;
> err = of_property_read_u32(np, "nvidia,ram-code", &value);
> if (err || value != ram_code) {
> struct device_node *lpddr2_np;
> bool cfg_mismatches = false;
>
> - lpddr2_np = of_find_node_by_name(np, "lpddr2");
> + lpddr2_np = of_get_child_by_name(np, "lpddr2");
Why?
> if (lpddr2_np) {
> const struct lpddr2_info *info;
>
> @@ -518,7 +519,6 @@ tegra_emc_find_node_by_ram_code(struct tegra_emc *emc)
> }
>
> if (cfg_mismatches) {
> - of_node_put(np);
If of_find_node_by_name() drops reference, why this was needed?
> continue;
Best regards,
Krzysztof
