From 8c9c68b87afb685ea6db81b915a5753c251c3212 Mon Sep 17 00:00:00 2001 From: Ioana Ciornei Date: Sat, 2 Nov 2024 17:47:52 +0800 Subject: [PATCH 1/2] net: mdio: use device_set_node() to setup both fwnode and of mainline inclusion from mainline-v5.14-rc1 commit 7e33d84db1a8a6c3000e9b02c074c17819680755 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRIU CVE: CVE-2022-48961 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7e33d84db1a8a6c3000e9b02c074c17819680755 -------------------------------- Use the newly introduced helper to setup both the of_node and the fwnode for a given device. Signed-off-by: Ioana Ciornei Signed-off-by: David S. Miller Conflicts: drivers/net/mdio/fwnode_mdio.c [bc1bee3b87ee ("net: mdiobus: Introduce fwnode_mdiobus_register_phy()") not merged] Signed-off-by: Zhang Changzhong --- drivers/net/mdio/of_mdio.c | 9 ++++----- drivers/net/phy/mdio_bus.c | 3 +-- 2 files changed, 5 insertions(+), 7 deletions(-) diff --git a/drivers/net/mdio/of_mdio.c b/drivers/net/mdio/of_mdio.c index 5bae47f3da40..e6ae22697aa1 100644 --- a/drivers/net/mdio/of_mdio.c +++ b/drivers/net/mdio/of_mdio.c @@ -151,6 +151,7 @@ static int of_mdiobus_register_phy(struct mii_bus *mdio, static int of_mdiobus_register_device(struct mii_bus *mdio, struct device_node *child, u32 addr) { + struct fwnode_handle *fwnode = of_fwnode_handle(child); struct mdio_device *mdiodev; int rc; @@ -161,9 +162,8 @@ static int of_mdiobus_register_device(struct mii_bus *mdio, /* Associate the OF node with the device structure so it * can be looked up later. */ - of_node_get(child); - mdiodev->dev.of_node = child; - mdiodev->dev.fwnode = of_fwnode_handle(child); + fwnode_handle_get(fwnode); + device_set_node(&mdiodev->dev, fwnode); /* All data is now stored in the mdiodev struct; register it. */ rc = mdio_device_register(mdiodev); @@ -262,8 +262,7 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np) * the device tree are populated after the bus has been registered */ mdio->phy_mask = ~0; - mdio->dev.of_node = np; - mdio->dev.fwnode = of_fwnode_handle(np); + device_set_node(&mdio->dev, of_fwnode_handle(np)); /* Get bus level PHY reset GPIO details */ mdio->reset_delay_us = DEFAULT_GPIO_RESET_DELAY; diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c index e9303be48655..33467f104255 100644 --- a/drivers/net/phy/mdio_bus.c +++ b/drivers/net/phy/mdio_bus.c @@ -463,8 +463,7 @@ static void of_mdiobus_link_mdiodev(struct mii_bus *bus, continue; if (addr == mdiodev->addr) { - dev->of_node = child; - dev->fwnode = of_fwnode_handle(child); + device_set_node(dev, of_fwnode_handle(child)); return; } } -- Gitee From 499688002fc6d353aeaee6da94c98c6ddce5f223 Mon Sep 17 00:00:00 2001 From: Zeng Heng Date: Sat, 2 Nov 2024 17:47:53 +0800 Subject: [PATCH 2/2] net: mdio: fix unbalanced fwnode reference count in mdio_device_release() mainline inclusion from mainline-v6.1 commit cb37617687f2bfa5b675df7779f869147c9002bd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRIU CVE: CVE-2022-48961 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cb37617687f2bfa5b675df7779f869147c9002bd -------------------------------- There is warning report about of_node refcount leak while probing mdio device: OF: ERROR: memory leak, expected refcount 1 instead of 2, of_node_get()/of_node_put() unbalanced - destroy cset entry: attach overlay node /spi/soc@0/mdio@710700c0/ethernet@4 In of_mdiobus_register_device(), we increase fwnode refcount by fwnode_handle_get() before associating the of_node with mdio device, but it has never been decreased in normal path. Since that, in mdio_device_release(), it needs to call fwnode_handle_put() in addition instead of calling kfree() directly. After above, just calling mdio_device_free() in the error handle path of of_mdiobus_register_device() is enough to keep the refcount balanced. Fixes: a9049e0c513c ("mdio: Add support for mdio drivers.") Signed-off-by: Zeng Heng Reviewed-by: Yang Yingliang Reviewed-by: Russell King (Oracle) Link: https://lore.kernel.org/r/20221203073441.3885317-1-zengheng4@huawei.com Signed-off-by: Paolo Abeni Signed-off-by: Zhang Changzhong --- drivers/net/mdio/of_mdio.c | 3 ++- drivers/net/phy/mdio_device.c | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/mdio/of_mdio.c b/drivers/net/mdio/of_mdio.c index e6ae22697aa1..44b24b21bf1c 100644 --- a/drivers/net/mdio/of_mdio.c +++ b/drivers/net/mdio/of_mdio.c @@ -168,8 +168,9 @@ static int of_mdiobus_register_device(struct mii_bus *mdio, /* All data is now stored in the mdiodev struct; register it. */ rc = mdio_device_register(mdiodev); if (rc) { + device_set_node(&mdiodev->dev, NULL); + fwnode_handle_put(fwnode); mdio_device_free(mdiodev); - of_node_put(child); return rc; } diff --git a/drivers/net/phy/mdio_device.c b/drivers/net/phy/mdio_device.c index 797c41f5590e..f72d18ee2792 100644 --- a/drivers/net/phy/mdio_device.c +++ b/drivers/net/phy/mdio_device.c @@ -21,6 +21,7 @@ #include #include #include +#include void mdio_device_free(struct mdio_device *mdiodev) { @@ -30,6 +31,7 @@ EXPORT_SYMBOL(mdio_device_free); static void mdio_device_release(struct device *dev) { + fwnode_handle_put(dev->fwnode); kfree(to_mdio_device(dev)); } -- Gitee