kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Joe Hattori 3b02273446 memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code() 
[ Upstream commit b9784e5cde ]

As of_find_node_by_name() release the reference of the argument device
node, tegra_emc_find_node_by_ram_code() releases some device nodes while
still in use, resulting in possible UAFs. According to the bindings and
the in-tree DTS files, the "emc-tables" node is always device's child
node with the property "nvidia,use-ram-code", and the "lpddr2" node is a
child of the "emc-tables" node. Thus utilize the
for_each_child_of_node() macro and of_get_child_by_name() instead of
of_find_node_by_name() to simplify the code.

This bug was found by an experimental verification tool that I am
developing.

Fixes: 96e5da7c84 ("memory: tegra: Introduce Tegra20 EMC driver")
Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20241217091434.1993597-1-joe@pf.is.s.u-tokyo.ac.jp
Link: https://lore.kernel.org/r/20241218024415.2494267-3-joe@pf.is.s.u-tokyo.ac.jp
[krzysztof: applied v1, adjust the commit msg to incorporate v2 parts]
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-02-08 09:57:41 +01:00
..
accel accel/ivpu: Fix WARN in ivpu_ipc_send_receive_internal() 2024-12-27 14:02:16 +01:00
accessibility treewide: remove unnecessary <linux/version.h> inclusion 2024-08-12 18:36:44 +09:00
acpi ACPI: fan: cleanup resources in the error path of .probe() 2025-02-08 09:57:05 +01:00
amba ARM: 9416/1: amba: make amba_bustype constant 2024-09-04 15:01:17 +01:00
android binder: add delivered_freeze to debugfs output 2024-12-09 10:41:11 +01:00
ata ata: sata_highbank: fix OF node reference leak in highbank_initialize_phys() 2024-12-19 18:13:03 +01:00
atm atm: idt77252: prevent use after free in dequeue_rx() 2024-08-12 10:41:44 +01:00
auxdisplay move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
base topology: Keep the cpumask unchanged when printing cpumap 2025-01-17 13:40:53 +01:00
bcma PCI: Rename CRS Completion Status to RRS 2024-09-10 19:52:30 -05:00
block nbd: don't allow reconnect after disconnect 2025-02-08 09:56:51 +01:00
bluetooth Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() 2025-02-08 09:57:23 +01:00
bus bus: mhi: host: Switch trace_mhi_gen_tre fields to native endian 2024-12-05 14:02:38 +01:00
cache cache: StarFive: Require a 64-bit system 2024-08-01 07:15:02 -07:00
cdrom cdrom: Avoid barrier_nospec() in cdrom_ioctl_media_changed() 2024-10-17 19:47:15 -06:00
cdx module: Convert default symbol namespace to string literal 2025-02-08 09:57:05 +01:00
char ipmi: ssif_bmc: Fix new request loss when bmc ready for a response 2025-02-08 09:57:10 +01:00
clk clk: analogbits: Fix incorrect calculation of vco rate delta 2025-02-08 09:57:23 +01:00
clocksource x86/hyperv: Fix hv tsc page based sched_clock for hibernation 2024-12-27 14:02:15 +01:00
comedi comedi: Flush partial mappings in error case 2024-12-05 14:02:46 +01:00
connector connector/cn_proc: revert "connector: Fix proc_event_num_listeners count not cleared" 2024-02-13 11:15:44 +01:00
counter counter: stm32-timer-cnt: fix device_node handling in probe_encoder() 2024-12-05 14:03:01 +01:00
cpufreq cpufreq: ACPI: Fix max-frequency computation 2025-02-08 09:57:22 +01:00
cpuidle cpuidle: teo: Update documentation after previous changes 2025-01-23 17:22:49 +01:00
crypto crypto: iaa - Fix IAA disabling that occurs when sync_mode is set to 'async' 2025-02-08 09:57:30 +01:00
cxl cxl/region: Fix region creation for greater than x2 switches 2024-12-27 14:02:01 +01:00
dax dax: delete a stale directory pmem 2024-12-05 14:02:13 +01:00
dca Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
devfreq PM / devfreq: imx-bus: Use of_property_present() 2024-09-05 01:23:56 +09:00
dio dio: Have dio_bus_match() callback take a const * 2024-07-10 15:38:14 +02:00
dma module: Convert default symbol namespace to string literal 2025-02-08 09:57:05 +01:00
dma-buf udmabuf: also check for F_SEAL_FUTURE_WRITE 2024-12-27 14:02:18 +01:00
dpll dpll: add Embedded SYNC feature for a pin 2024-08-26 19:21:14 -07:00
edac EDAC/amd64: Simplify ECC check on unified memory controllers 2024-12-27 14:02:06 +01:00
eisa driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
extcon Char/Misc and other driver changes for 6.12-rc1 2024-09-26 10:13:08 -07:00
firewire firewire: core: fix invalid port index for parent device 2024-10-27 11:14:35 +09:00
firmware efi/zboot: Limit compression options to GZIP and ZSTD 2025-01-23 17:22:47 +01:00
fpga move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
fsi move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
gnss [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
gpio gpio: pca953x: log an error when failing to get the reset GPIO 2025-02-08 09:57:07 +01:00
gpu drm/amdgpu: fix gpu recovery disable with per queue reset 2025-02-08 09:57:00 +01:00
greybus move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
hid HID: fix generic desktop D-Pad controls 2025-02-08 09:57:11 +01:00
hsi HSI: omap-ssi: Remove unnecessary debugfs_create_dir() error check 2024-08-27 15:28:56 +02:00
hte hte: tegra-194: add missing MODULE_DESCRIPTION() macro 2024-06-19 12:24:03 -07:00
hv Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet 2024-12-27 14:02:15 +01:00
hwmon hwmon: Fix help text for aspeed-g6-pwm-tach 2025-02-08 09:57:13 +01:00
hwspinlock hwspinlock: qcom: implement bust operation 2024-05-29 12:52:26 -07:00
hwtracing [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
i2c i2c: designware: Actually make use of the I2C_DW_COMMON and I2C_DW symbol namespaces 2025-02-08 09:57:22 +01:00
i3c i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock 2024-12-14 20:04:05 +01:00
idle intel_idle: fix ACPI _CST matching for newer Xeon platforms 2024-09-25 22:30:33 +02:00
iio iio: imu: inv_icm42600: fix spi burst write not supported 2025-01-17 13:41:00 +01:00
infiniband RDMA/srp: Fix error handling in srp_add_port 2025-02-08 09:57:40 +01:00
input Input: xpad - add support for wooting two he (arm) 2025-02-01 18:39:40 +01:00
interconnect interconnect: qcom: icc-rpmh: probe defer incase of missing QoS clock dependency 2024-12-05 14:02:37 +01:00
iommu iommu/amd: Remove unused amd_iommu_domain_update() 2025-02-08 09:57:34 +01:00
ipack driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
irqchip irqchip/sunxi-nmi: Add missing SKIP_WAKE flag 2025-02-01 18:39:36 +01:00
isdn move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
leds leds: cht-wcove: Use devm_led_classdev_register() to avoid memory leak 2025-02-08 09:57:11 +01:00
macintosh move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
mailbox mailbox: pcc: Check before sending MCTP PCC response ACK 2024-12-14 20:04:03 +01:00
mcb Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
md dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2) 2025-01-17 13:40:46 +01:00
media media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg 2025-01-02 10:34:09 +01:00
memory memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code() 2025-02-08 09:57:41 +01:00
memstick move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
message scsi: fusion: Remove unused variable 'rc' 2024-12-05 14:02:10 +01:00
mfd mfd: syscon: Fix race in device_node_get_regmap() 2025-02-08 09:57:11 +01:00
misc misc: microchip: pci1xxxx: Resolve return code mismatch during GPIO set config 2025-01-17 13:40:53 +01:00
mmc mmc: sdhci-msm: fix crypto key eviction 2025-01-09 13:33:32 +01:00
most Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
mtd Revert "mtd: spi-nor: core: replace dummy buswidth from addr to data" 2025-01-23 17:22:53 +01:00
mux mux: remove usage of the deprecated ida_simple_xx() API 2024-04-29 08:20:07 -07:00
net net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns() 2025-02-08 09:57:25 +01:00
nfc move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
ntb ntb: Force physically contiguous allocation of rx ring buffers 2024-09-20 10:51:25 -04:00
nubus nubus: Make nubus_bus_type static and constant 2024-01-03 13:33:59 +01:00
nvdimm nvdimm: rectify the illogical code within nd_dax_probe() 2024-12-14 20:04:02 +01:00
nvme nvme: fix bogus kzalloc() return check in nvme_init_effects_log() 2025-02-08 09:56:53 +01:00
nvmem nvmem: core: Check read_only flag for force_ro in bin_attr_nvmem_write() 2024-12-09 10:41:03 +01:00
of of/unittest: Add test that of_address_to_resource() fails on non-translatable address 2025-02-01 18:39:35 +01:00
opp OPP: OF: Fix an OF node leak in _opp_add_static_v2() 2025-02-08 09:57:10 +01:00
parisc parisc: pdc_stable: Constify struct kobj_type 2024-09-09 08:53:17 +02:00
parport parport: Proper fix for array out-of-bounds access 2024-10-13 18:17:35 +02:00
pci PCI/MSI: Handle lack of irqdomain gracefully 2025-01-02 10:34:22 +01:00
pcmcia move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
peci move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
perf drivers/perf: riscv: Return error for default case 2025-01-17 13:40:45 +01:00
phy phy: rockchip: naneng-combphy: fix phy reset 2025-01-02 10:34:13 +01:00
pinctrl pinctrl: amd: Take suspend type into consideration which pins are non-wake 2025-02-08 09:57:33 +01:00
platform platform/x86: x86-android-tablets: make platform data be static 2025-02-08 09:57:26 +01:00
pmdomain pmdomain: imx8mp-blk-ctrl: add missing loop break condition 2025-01-23 17:23:01 +01:00
pnp driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
power power: supply: gpio-charger: Fix set charge current limits 2025-01-02 10:34:24 +01:00
powercap powercap: dtpm_devfreq: Fix error check against dev_pm_qos_add_request() 2024-10-21 13:23:06 +02:00
pps [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
ps3 driver/ps3: Include <video/cmdline.h> for mode parsing 2023-02-20 14:56:51 +01:00
ptp ptp: kvm: x86: Return EOPNOTSUPP instead of ENODEV from kvm_arch_ptp_init() 2024-12-19 18:13:13 +01:00
pwm pwm: stm32: Add check for clk_enable() 2025-02-08 09:57:23 +01:00
rapidio driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
ras RAS/AMD/ATL: Translate normalized to system physical addresses using PRM 2024-08-01 14:36:29 +02:00
regulator regulator: of: Implement the unwind path of of_regulator_match() 2025-02-08 09:57:10 +01:00
remoteproc remoteproc: qcom: pas: enable SAR2130P audio DSP support 2024-12-14 20:04:05 +01:00
reset reset: rzg2l-usbphy-ctrl: Assign proper of node to the allocated device 2025-01-23 17:22:52 +01:00
rpmsg rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length 2024-12-05 14:02:25 +01:00
rtc rtc: cmos: avoid taking rtc_lock for extended period of time 2024-12-14 20:04:09 +01:00
s390 s390/cio: Do not unregister the subchannel based on DNV 2024-12-05 14:01:11 +01:00
sbus [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
scsi scsi: storvsc: Ratelimit warning logs to prevent VM denial of service 2025-02-01 18:39:38 +01:00
sh sh: intc: Fix use-after-free bug in register_intc_controller() 2024-12-05 14:03:10 +01:00
siox Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
slimbus slimbus: qcom-ngd-ctrl: use 'time_left' variable with wait_for_completion_timeout() 2024-09-03 12:10:38 +02:00
soc soc: atmel: fix device_node release in atmel_soc_device_init() 2025-02-08 09:57:36 +01:00
soundwire soundwire: intel_ace2x: Send PDI stream number during prepare 2024-10-17 12:11:19 +01:00
spi spi: zynq-qspi: Add check for clk_enable() 2025-02-08 09:57:03 +01:00
spmi spmi: pmic-arb: fix return path in for_each_available_child_of_node() 2024-12-09 10:41:03 +01:00
ssb driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
staging staging: iio: ad9832: Correct phase range check 2025-01-17 13:40:52 +01:00
target scsi: target: Fix incorrect function name in pscsi_create_type_disk() 2024-12-05 14:02:10 +01:00
tc driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
tee optee: Fix a NULL vs IS_ERR() check 2024-09-09 12:22:06 +02:00
thermal thermal: of: fix OF node leak in of_thermal_zone_find() 2025-01-17 13:40:48 +01:00
thunderbolt thunderbolt: Don't display nvm_version unless upgrade supported 2024-12-27 14:02:09 +01:00
tty module: Convert default symbol namespace to string literal 2025-02-08 09:57:05 +01:00
ufs scsi: ufs: core: Honor runtime/system PM levels if set by host controller drivers 2025-01-23 17:22:55 +01:00
uio uio: Constify struct kobj_type 2024-09-11 16:02:54 +02:00
usb module: Convert default symbol namespace to string literal 2025-02-08 09:57:05 +01:00
vdpa vdpa/mlx5: Fix suboptimal range on iotlb iteration 2024-12-05 14:02:28 +01:00
vfio vfio/platform: check the bounds of read/write syscalls 2025-02-01 18:39:38 +01:00
vhost virtio: bugfixes 2024-10-07 11:33:26 -07:00
video fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() 2024-12-05 14:02:14 +01:00
virt virt: tdx-guest: Just leak decrypted memory on unrecoverable errors 2025-01-02 10:34:22 +01:00
virtio virtio_ring: add a func argument 'recycle_done' to virtqueue_resize() 2024-12-19 18:12:59 +01:00
w1 w1: ds2482: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-09-06 19:18:32 +02:00
watchdog watchdog: mediatek: Add support for MT6735 TOPRGU/WDT 2025-01-02 10:34:16 +01:00
xen xen: Fix the issue of resource not being properly released in xenbus_dev_probe() 2024-12-05 14:02:40 +01:00
zorro Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
Kconfig - removed AR7 platform support 2023-11-10 09:19:46 -08:00
Makefile leds: Init leds class earlier 2024-09-04 17:24:58 -05:00