[v1] interconnect: imx: fix use-after-free in imx_icc_node_init_qos()

[PATCH] interconnect: imx: fix use-after-free in imx_icc_node_init_qos()

Posted by Wentao Liang 2 months, 1 week ago

Move of_node_put(dn) after the last use of dn, and add a missing put
in the error path to avoid both use-after-free and reference leak.

Fixes: f0d8048525d7 ("interconnect: Add imx core driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/interconnect/imx/imx.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/interconnect/imx/imx.c b/drivers/interconnect/imx/imx.c
index 9511f80cf041..75431b5ccef8 100644
--- a/drivers/interconnect/imx/imx.c
+++ b/drivers/interconnect/imx/imx.c
@@ -143,15 +143,16 @@ static int imx_icc_node_init_qos(struct icc_provider *provider,
 		}
 
 		pdev = of_find_device_by_node(dn);
-		of_node_put(dn);
 		if (!pdev) {
 			dev_warn(dev, "node %s[%d] missing device for %pOF\n",
 				 node->name, node->id, dn);
+			of_node_put(dn);
 			return -EPROBE_DEFER;
 		}
 		node_data->qos_dev = &pdev->dev;
 		dev_dbg(dev, "node %s[%d] has device node %pOF\n",
 			node->name, node->id, dn);
+		of_node_put(dn);
 	}
 
 	return dev_pm_qos_add_request(node_data->qos_dev,
-- 
2.34.1

Re: [PATCH] interconnect: imx: fix use-after-free in imx_icc_node_init_qos()

Posted by Markus Elfring 2 months, 1 week ago

> Move of_node_put(dn) after the last use of dn, and add a missing put
> in the error path to avoid both use-after-free and reference leak.

How do you think about to increase the application of scope-based resource management?
https://elixir.bootlin.com/linux/v7.0-rc7/source/include/linux/of.h#L138
https://elixir.bootlin.com/linux/v7.0-rc7/source/drivers/interconnect/imx/imx.c#L117-L160

Regards,
Markus

Re: [PATCH] interconnect: imx: fix use-after-free in imx_icc_node_init_qos()

Posted by Frank Li 2 months, 1 week ago

On Wed, Apr 08, 2026 at 03:10:04AM +0000, Wentao Liang wrote:
> Move of_node_put(dn) after the last use of dn, and add a missing put
> in the error path to avoid both use-after-free and reference leak.
>
> Fixes: f0d8048525d7 ("interconnect: Add imx core driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/interconnect/imx/imx.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/interconnect/imx/imx.c b/drivers/interconnect/imx/imx.c
> index 9511f80cf041..75431b5ccef8 100644
> --- a/drivers/interconnect/imx/imx.c
> +++ b/drivers/interconnect/imx/imx.c
> @@ -143,15 +143,16 @@ static int imx_icc_node_init_qos(struct icc_provider *provider,
>  		}
>

Please use auto cleanup to fix this problem

struct device_node * __free(device_nod) dn = of_parse_phandle(dev->of_node, adj->phandle_name, 0);

Frank
>  		pdev = of_find_device_by_node(dn);
> -		of_node_put(dn);
>  		if (!pdev) {
>  			dev_warn(dev, "node %s[%d] missing device for %pOF\n",
>  				 node->name, node->id, dn);
> +			of_node_put(dn);
>  			return -EPROBE_DEFER;
>  		}
>  		node_data->qos_dev = &pdev->dev;
>  		dev_dbg(dev, "node %s[%d] has device node %pOF\n",
>  			node->name, node->id, dn);
> +		of_node_put(dn);
>  	}
>
>  	return dev_pm_qos_add_request(node_data->qos_dev,
> --
> 2.34.1
>