This is a note to let you know that I've just added the patch titled
pinctrl: avoid unsafe code pattern in find_pinctrl()
to the 5.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
pinctrl-avoid-unsafe-code-pattern-in-find_pinctrl.patch
and it can be found in the queue-5.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From c153a4edff6ab01370fcac8e46f9c89cca1060c2 Mon Sep 17 00:00:00 2001
From: Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
Date: Wed, 20 Sep 2023 11:09:10 -0700
Subject: pinctrl: avoid unsafe code pattern in find_pinctrl()
From: Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
commit c153a4edff6ab01370fcac8e46f9c89cca1060c2 upstream.
The code in find_pinctrl() takes a mutex and traverses a list of pinctrl
structures. Later the caller bumps up reference count on the found
structure. Such pattern is not safe as pinctrl that was found may get
deleted before the caller gets around to increasing the reference count.
Fix this by taking the reference count in find_pinctrl(), while it still
holds the mutex.
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
Link: https://lore.kernel.org/r/ZQs1RgTKg6VJqmPs@xxxxxxxxxx
Signed-off-by: Linus Walleij <linus.walleij@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/pinctrl/core.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -1005,17 +1005,20 @@ static int add_setting(struct pinctrl *p
static struct pinctrl *find_pinctrl(struct device *dev)
{
- struct pinctrl *p;
+ struct pinctrl *entry, *p = NULL;
mutex_lock(&pinctrl_list_mutex);
- list_for_each_entry(p, &pinctrl_list, node)
- if (p->dev == dev) {
- mutex_unlock(&pinctrl_list_mutex);
- return p;
+
+ list_for_each_entry(entry, &pinctrl_list, node) {
+ if (entry->dev == dev) {
+ p = entry;
+ kref_get(&p->users);
+ break;
}
+ }
mutex_unlock(&pinctrl_list_mutex);
- return NULL;
+ return p;
}
static void pinctrl_free(struct pinctrl *p, bool inlist);
@@ -1124,7 +1127,6 @@ struct pinctrl *pinctrl_get(struct devic
p = find_pinctrl(dev);
if (p) {
dev_dbg(dev, "obtain a copy of previously claimed pinctrl\n");
- kref_get(&p->users);
return p;
}
Patches currently in stable-queue which might be from dmitry.torokhov@xxxxxxxxx are
queue-5.4/pinctrl-avoid-unsafe-code-pattern-in-find_pinctrl.patch
queue-5.4/input-psmouse-fix-fast_reconnect-function-for-ps-2-mode.patch
queue-5.4/input-powermate-fix-use-after-free-in-powermate_config_complete.patch
queue-5.4/input-xpad-add-pxn-v900-support.patch
