From c592fafbdbb6b1279b76a54722d1465ca77e5bde Mon Sep 17 00:00:00 2001 From: Johan Hovold Date: Tue, 6 Jun 2017 17:59:03 +0200 Subject: thermal: max77620: fix device-node reference imbalance The thermal child device reuses the parent MFD-device device-tree node when registering a thermal zone, but did not take a reference to the node. This leads to a reference imbalance, and potential use-after-free, when the node reference is dropped by the platform-bus device destructor (once for the child and later again for the parent). Fix this by dropping any reference already held to a device-tree node and getting a reference to the parent's node which will be balanced on reprobe or on platform-device release, whichever comes first. Note that simply clearing the of_node pointer on probe errors and on driver unbind would not allow the use of device-managed resources as specifically thermal_zone_of_sensor_unregister() claims that a valid device-tree node pointer is needed during deregistration (even if it currently does not seem to use it). Fixes: ec4664b3fd6d ("thermal: max77620: Add thermal driver for reporting junction temp") Cc: stable # 4.9 Cc: Laxman Dewangan Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman --- drivers/thermal/max77620_thermal.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'drivers/thermal') diff --git a/drivers/thermal/max77620_thermal.c b/drivers/thermal/max77620_thermal.c index e9a1fe342760..71d35f3c9215 100644 --- a/drivers/thermal/max77620_thermal.c +++ b/drivers/thermal/max77620_thermal.c @@ -104,8 +104,6 @@ static int max77620_thermal_probe(struct platform_device *pdev) return -EINVAL; } - pdev->dev.of_node = pdev->dev.parent->of_node; - mtherm->dev = &pdev->dev; mtherm->rmap = dev_get_regmap(pdev->dev.parent, NULL); if (!mtherm->rmap) { @@ -113,6 +111,14 @@ static int max77620_thermal_probe(struct platform_device *pdev) return -ENODEV; } + /* + * Drop any current reference to a device-tree node and get a + * reference to the parent's node which will be balanced on reprobe or + * on platform-device release. + */ + of_node_put(pdev->dev.of_node); + pdev->dev.of_node = of_node_get(pdev->dev.parent->of_node); + mtherm->tz_device = devm_thermal_zone_of_sensor_register(&pdev->dev, 0, mtherm, &max77620_thermal_ops); if (IS_ERR(mtherm->tz_device)) { -- cgit v1.2.3 From ce046e5d9b489554c29ae9277cdc2f86dee76a84 Mon Sep 17 00:00:00 2001 From: Johan Hovold Date: Tue, 6 Jun 2017 17:59:04 +0200 Subject: thermal: max77620: fix pinmux conflict on reprobe Use the new helper for reusing a device-tree node of another device instead of managing the node references explicitly. This also makes sure that the new of_node_reuse flag is set if the device is ever reprobed, something which specifically now avoids driver core from attempting to claim any pinmux resources already claimed by the parent device. Fixes: ec4664b3fd6d ("thermal: max77620: Add thermal driver for reporting junction temp") Cc: Laxman Dewangan Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman --- drivers/thermal/max77620_thermal.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) (limited to 'drivers/thermal') diff --git a/drivers/thermal/max77620_thermal.c b/drivers/thermal/max77620_thermal.c index 71d35f3c9215..159bbcee8821 100644 --- a/drivers/thermal/max77620_thermal.c +++ b/drivers/thermal/max77620_thermal.c @@ -112,12 +112,10 @@ static int max77620_thermal_probe(struct platform_device *pdev) } /* - * Drop any current reference to a device-tree node and get a - * reference to the parent's node which will be balanced on reprobe or - * on platform-device release. + * The reference taken to the parent's node which will be balanced on + * reprobe or on platform-device release. */ - of_node_put(pdev->dev.of_node); - pdev->dev.of_node = of_node_get(pdev->dev.parent->of_node); + device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent); mtherm->tz_device = devm_thermal_zone_of_sensor_register(&pdev->dev, 0, mtherm, &max77620_thermal_ops); -- cgit v1.2.3