Commit 2a433d32 authored Sep 20, 2023 by Dmitry Torokhov Committed by Greg Kroah-Hartman Oct 25, 2023

pinctrl: avoid unsafe code pattern in find_pinctrl()



commit c153a4edff6ab01370fcac8e46f9c89cca1060c2 upstream.

The code in find_pinctrl() takes a mutex and traverses a list of pinctrl
structures. Later the caller bumps up reference count on the found
structure. Such pattern is not safe as pinctrl that was found may get
deleted before the caller gets around to increasing the reference count.

Fix this by taking the reference count in find_pinctrl(), while it still
holds the mutex.

Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Link: https://lore.kernel.org/r/ZQs1RgTKg6VJqmPs@google.com


Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent d5b11bd8

drivers/pinctrl/core.c

+9 −7

Original line number	Diff line number	Diff line
		@@ -1005,17 +1005,20 @@ static int add_setting(struct pinctrl p, struct pinctrl_dev pctldev,

		static struct pinctrl find_pinctrl(struct device dev)
		{
		struct pinctrl *p;
		struct pinctrl entry, p = NULL;

		mutex_lock(&pinctrl_list_mutex);
		list_for_each_entry(p, &pinctrl_list, node)
		if (p->dev == dev) {
		mutex_unlock(&pinctrl_list_mutex);
		return p;

		list_for_each_entry(entry, &pinctrl_list, node) {
		if (entry->dev == dev) {
		p = entry;
		kref_get(&p->users);
		break;
		}
		}

		mutex_unlock(&pinctrl_list_mutex);
		return NULL;
		return p;
		}

		static void pinctrl_free(struct pinctrl *p, bool inlist);
		@@ -1124,7 +1127,6 @@ struct pinctrl pinctrl_get(struct device dev)
		p = find_pinctrl(dev);
		if (p) {
		dev_dbg(dev, "obtain a copy of previously claimed pinctrl\n");
		kref_get(&p->users);
		return p;
		}