Re: [PATCH] staging: media: tegra-video: fix device_node use after free

[Dan Carpenter]

On Fri, Oct 28, 2022 at 06:58:47PM +0200, Luca Ceresoli wrote:
> Hello Dan,
> 
> On Fri, 28 Oct 2022 15:34:39 +0300
> Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote:
> 
> > On Fri, Oct 28, 2022 at 10:19:26AM +0200, luca.ceresoli@xxxxxxxxxxx wrote:
> > > From: Luca Ceresoli <luca.ceresoli@xxxxxxxxxxx>
> > > 
> > > At probe time this code path is followed:
> > > 
> > >  * tegra_csi_init
> > >    * tegra_csi_channels_alloc
> > >      * for_each_child_of_node(node, channel) -- iterates over channels
> > >        * automatically gets 'channel'
> > >          * tegra_csi_channel_alloc()
> > >            * saves into chan->of_node a pointer to the channel OF node
> > >        * automatically gets and puts 'channel'
> > >        * now the node saved in chan->of_node has refcount 0, can disappear
> > >    * tegra_csi_channels_init
> > >      * iterates over channels
> > >        * tegra_csi_channel_init -- uses chan->of_node
> > > 
> > > After that, chan->of_node keeps storing the node until the device is
> > > removed.
> > > 
> > > of_node_get() the node and of_node_put() it during teardown to avoid any
> > > risk.
> > > 
> > > Fixes: 1ebaeb09830f ("media: tegra-video: Add support for external sensor capture")
> > > Cc: stable@xxxxxxxxxxxxxxx
> > > Cc: Sowjanya Komatineni <skomatineni@xxxxxxxxxx>
> > > Signed-off-by: Luca Ceresoli <luca.ceresoli@xxxxxxxxxxx>
> > > ---
> > >  drivers/staging/media/tegra-video/csi.c | 3 ++-
> > >  1 file changed, 2 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/drivers/staging/media/tegra-video/csi.c b/drivers/staging/media/tegra-video/csi.c
> > > index b26e44adb2be..1b05f620b476 100644
> > > --- a/drivers/staging/media/tegra-video/csi.c
> > > +++ b/drivers/staging/media/tegra-video/csi.c
> > > @@ -433,7 +433,7 @@ static int tegra_csi_channel_alloc(struct tegra_csi *csi,
> > >  	for (i = 0; i < chan->numgangports; i++)
> > >  		chan->csi_port_nums[i] = port_num + i * CSI_PORTS_PER_BRICK;
> > >  
> > > -	chan->of_node = node;
> > > +	chan->of_node = of_node_get(node);
> > >  	chan->numpads = num_pads;
> > >  	if (num_pads & 0x2) {
> > >  		chan->pads[0].flags = MEDIA_PAD_FL_SINK;
> > > @@ -640,6 +640,7 @@ static void tegra_csi_channels_cleanup(struct tegra_csi *csi)
> > >  			media_entity_cleanup(&subdev->entity);
> > >  		}
> > >  
> > > +		of_node_put(chan->of_node);
> > >  		list_del(&chan->list);
> > >  		kfree(chan);  
> > 
> > Not related to your patch, but this kind of "one function cleans up
> > everything" style is always buggy.  For example, here it should be:
> > 
> > -		if (chan->mipi)
> > +		if (!IS_ERR_OR_NULL(chan->mipi))
> > 			tegra_mipi_free(chan->mipi);
> 
> I sort of agree the code could be clearer here, but looking at the code
> in detail, this cannot happen. chan->mipi is set in one place only, and
> if it is an error the whole probe fails. So it can be either NULL or a
> valid pointer here.

I assumed that tegra_csi_channels_cleanup() would clean up if
tegra_csi_channel_alloc() fails.  Otherwise then that's several
different even worse bugs.

HINT: Let's all hope my initial analysis was correct.

> 
> Regarding my patch, do you think it is valid?

It sort of depends on if the "chan->mipi" dereference can crash like I
explained above.  If there is no ->mipi crash then the error handling
needs to be fixed.

regards,
dan carpenter