From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp> stable inclusion from stable-v6.1.129 commit e9d07e91de140679eeaf275f47ad154467cb9e05 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLHK CVE: CVE-2024-58034 Reference: https://git.kernel.org/stable/c/e9d07e91de140679eeaf275f47ad154467cb9e05 -------------------------------- [ Upstream commit b9784e5cde1f9fb83661a70e580e381ae1264d12 ] As of_find_node_by_name() release the reference of the argument device node, tegra_emc_find_node_by_ram_code() releases some device nodes while still in use, resulting in possible UAFs. According to the bindings and the in-tree DTS files, the "emc-tables" node is always device's child node with the property "nvidia,use-ram-code", and the "lpddr2" node is a child of the "emc-tables" node. Thus utilize the for_each_child_of_node() macro and of_get_child_by_name() instead of of_find_node_by_name() to simplify the code. This bug was found by an experimental verification tool that I am developing. Fixes: 96e5da7c8424 ("memory: tegra: Introduce Tegra20 EMC driver") Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp> Link: https://lore.kernel.org/r/20241217091434.1993597-1-joe@pf.is.s.u-tokyo.ac.jp Link: https://lore.kernel.org/r/20241218024415.2494267-3-joe@pf.is.s.u-tokyo.ac.jp [krzysztof: applied v1, adjust the commit msg to incorporate v2 parts] Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Conflicts: drivers/memory/tegra/tegra20-emc.c [1. Context differences; 2. The current hulk-5.10 version does not introduce the function tegra_emc_find_node_by_ram_code and lpddr2 related queries, so CVE bugfix for this part does not involved.] Signed-off-by: Lulu Yao <yaolulu5@huawei.com> Signed-off-by: Wupeng Ma <mawupeng1@huawei.com> --- drivers/memory/tegra/tegra20-emc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/memory/tegra/tegra20-emc.c b/drivers/memory/tegra/tegra20-emc.c index 027f46287dbf..a6f73c7521dc 100644 --- a/drivers/memory/tegra/tegra20-emc.c +++ b/drivers/memory/tegra/tegra20-emc.c @@ -388,8 +388,9 @@ tegra_emc_find_node_by_ram_code(struct device *dev) ram_code = tegra_read_ram_code(); - for (np = of_find_node_by_name(dev->of_node, "emc-tables"); np; - np = of_find_node_by_name(np, "emc-tables")) { + for_each_child_of_node(dev->of_node, np) { + if (!of_node_name_eq(np, "emc-tables")) + continue; err = of_property_read_u32(np, "nvidia,ram-code", &value); if (err || value != ram_code) { of_node_put(np); -- 2.43.0