Skip to content

Commit e25f702

Browse files
zampierilucaszampierilucas
committed
Merge: of: Fix double free in of_parse_phandle_with_args_map and of: unittest fixes
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/4276 Description: Updates of: Fix double free in of_parse_phandle_with_args_map and of: unittest fixes JIRA: https://issues.redhat.com/browse/RHEL-37072 CVE: CVE-2023-52679 Build Info: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=61350930 Tested: Sanity booted on ARM (nvidia-igx-02) system. Signed-off-by: Steve Best <sbest@redhat.com> Approved-by: Tony Camuso <tcamuso@redhat.com> Approved-by: David Arcari <darcari@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: Lucas Zampieri <lzampier@redhat.com>
2 parents c04c536 + cbdef31 commit e25f702

File tree

3 files changed

+59
-32
lines changed

3 files changed

+59
-32
lines changed

‎drivers/of/base.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1463,6 +1463,7 @@ int of_parse_phandle_with_args_map(const struct device_node *np,
14631463
out_args->np = new;
14641464
of_node_put(cur);
14651465
cur = new;
1466+
new = NULL;
14661467
}
14671468
put:
14681469
of_node_put(cur);

‎drivers/of/unittest-data/tests-phandle.dtsi‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,13 @@
3838
phandle-map-pass-thru = <0x0 0xf0>;
3939
};
4040

41+
provider5: provider5 {
42+
#phandle-cells = <2>;
43+
phandle-map = <2 7 &provider4 2 3>;
44+
phandle-map-mask = <0xff 0xf>;
45+
phandle-map-pass-thru = <0x0 0xf0>;
46+
};
47+
4148
consumer-a {
4249
phandle-list = <&provider1 1>,
4350
<&provider2 2 0>,
@@ -64,7 +71,8 @@
6471
<&provider4 4 0x100>,
6572
<&provider4 0 0x61>,
6673
<&provider0>,
67-
<&provider4 19 0x20>;
74+
<&provider4 19 0x20>,
75+
<&provider5 2 7>;
6876
phandle-list-bad-phandle = <12345678 0 0>;
6977
phandle-list-bad-args = <&provider2 1 0>,
7078
<&provider4 0>;

‎drivers/of/unittest.c‎

Lines changed: 49 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,12 @@ static struct unittest_results {
4949
failed; \
5050
})
5151

52+
#ifdef CONFIG_OF_KOBJ
53+
#define OF_KREF_READ(NODE) kref_read(&(NODE)->kobj.kref)
54+
#else
55+
#define OF_KREF_READ(NODE) 1
56+
#endif
57+
5258
/*
5359
* Expected message may have a message level other than KERN_INFO.
5460
* Print the expected message only if the current loglevel will allow
@@ -448,6 +454,9 @@ static void __init of_unittest_parse_phandle_with_args(void)
448454

449455
unittest(passed, "index %i - data error on node %pOF rc=%i\n",
450456
i, args.np, rc);
457+
458+
if (rc == 0)
459+
of_node_put(args.np);
451460
}
452461

453462
/* Check for missing list property */
@@ -537,8 +546,9 @@ static void __init of_unittest_parse_phandle_with_args(void)
537546

538547
static void __init of_unittest_parse_phandle_with_args_map(void)
539548
{
540-
struct device_node *np, *p0, *p1, *p2, *p3;
549+
struct device_node *np, *p[6] = {};
541550
struct of_phandle_args args;
551+
unsigned int prefs[6];
542552
int i, rc;
543553

544554
np = of_find_node_by_path("/testcase-data/phandle-tests/consumer-b");
@@ -547,34 +557,24 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
547557
return;
548558
}
549559

550-
p0 = of_find_node_by_path("/testcase-data/phandle-tests/provider0");
551-
if (!p0) {
552-
pr_err("missing testcase data\n");
553-
return;
554-
}
555-
556-
p1 = of_find_node_by_path("/testcase-data/phandle-tests/provider1");
557-
if (!p1) {
558-
pr_err("missing testcase data\n");
559-
return;
560-
}
561-
562-
p2 = of_find_node_by_path("/testcase-data/phandle-tests/provider2");
563-
if (!p2) {
564-
pr_err("missing testcase data\n");
565-
return;
566-
}
567-
568-
p3 = of_find_node_by_path("/testcase-data/phandle-tests/provider3");
569-
if (!p3) {
570-
pr_err("missing testcase data\n");
571-
return;
560+
p[0] = of_find_node_by_path("/testcase-data/phandle-tests/provider0");
561+
p[1] = of_find_node_by_path("/testcase-data/phandle-tests/provider1");
562+
p[2] = of_find_node_by_path("/testcase-data/phandle-tests/provider2");
563+
p[3] = of_find_node_by_path("/testcase-data/phandle-tests/provider3");
564+
p[4] = of_find_node_by_path("/testcase-data/phandle-tests/provider4");
565+
p[5] = of_find_node_by_path("/testcase-data/phandle-tests/provider5");
566+
for (i = 0; i < ARRAY_SIZE(p); ++i) {
567+
if (!p[i]) {
568+
pr_err("missing testcase data\n");
569+
return;
570+
}
571+
prefs[i] = OF_KREF_READ(p[i]);
572572
}
573573

574574
rc = of_count_phandle_with_args(np, "phandle-list", "#phandle-cells");
575-
unittest(rc == 7, "of_count_phandle_with_args() returned %i, expected 7\n", rc);
575+
unittest(rc == 8, "of_count_phandle_with_args() returned %i, expected 8\n", rc);
576576

577-
for (i = 0; i < 8; i++) {
577+
for (i = 0; i < 9; i++) {
578578
bool passed = true;
579579

580580
memset(&args, 0, sizeof(args));
@@ -585,13 +585,13 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
585585
switch (i) {
586586
case 0:
587587
passed &= !rc;
588-
passed &= (args.np == p1);
588+
passed &= (args.np == p[1]);
589589
passed &= (args.args_count == 1);
590590
passed &= (args.args[0] == 1);
591591
break;
592592
case 1:
593593
passed &= !rc;
594-
passed &= (args.np == p3);
594+
passed &= (args.np == p[3]);
595595
passed &= (args.args_count == 3);
596596
passed &= (args.args[0] == 2);
597597
passed &= (args.args[1] == 5);
@@ -602,28 +602,36 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
602602
break;
603603
case 3:
604604
passed &= !rc;
605-
passed &= (args.np == p0);
605+
passed &= (args.np == p[0]);
606606
passed &= (args.args_count == 0);
607607
break;
608608
case 4:
609609
passed &= !rc;
610-
passed &= (args.np == p1);
610+
passed &= (args.np == p[1]);
611611
passed &= (args.args_count == 1);
612612
passed &= (args.args[0] == 3);
613613
break;
614614
case 5:
615615
passed &= !rc;
616-
passed &= (args.np == p0);
616+
passed &= (args.np == p[0]);
617617
passed &= (args.args_count == 0);
618618
break;
619619
case 6:
620620
passed &= !rc;
621-
passed &= (args.np == p2);
621+
passed &= (args.np == p[2]);
622622
passed &= (args.args_count == 2);
623623
passed &= (args.args[0] == 15);
624624
passed &= (args.args[1] == 0x20);
625625
break;
626626
case 7:
627+
passed &= !rc;
628+
passed &= (args.np == p[3]);
629+
passed &= (args.args_count == 3);
630+
passed &= (args.args[0] == 2);
631+
passed &= (args.args[1] == 5);
632+
passed &= (args.args[2] == 3);
633+
break;
634+
case 8:
627635
passed &= (rc == -ENOENT);
628636
break;
629637
default:
@@ -632,6 +640,9 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
632640

633641
unittest(passed, "index %i - data error on node %s rc=%i\n",
634642
i, args.np->full_name, rc);
643+
644+
if (rc == 0)
645+
of_node_put(args.np);
635646
}
636647

637648
/* Check for missing list property */
@@ -678,6 +689,13 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
678689
"OF: /testcase-data/phandle-tests/consumer-b: #phandle-cells = 2 found 1");
679690

680691
unittest(rc == -EINVAL, "expected:%i got:%i\n", -EINVAL, rc);
692+
693+
for (i = 0; i < ARRAY_SIZE(p); ++i) {
694+
unittest(prefs[i] == OF_KREF_READ(p[i]),
695+
"provider%d: expected:%d got:%d\n",
696+
i, prefs[i], OF_KREF_READ(p[i]));
697+
of_node_put(p[i]);
698+
}
681699
}
682700

683701
static void __init of_unittest_property_string(void)

0 commit comments

Comments
 (0)