openwrt-mirror/openwrt
1
0
Fork 0
mirror of https://github.com/openwrt/openwrt.git synced 2026-06-17 14:50:15 +04:00
Code Issues Packages Projects Releases Wiki Activity

realtek: pcs: fix use after free

Browse Source 
In rtpcs_probe_serdes_bus(), the code manages the device
tree node reference incorrectly:

- It acquires a node pointer np via of_find_compatible_node(),
  which increments the reference count.

- It calls of_mdio_find_bus(np) to locate the bus.

- It calls of_node_put(np), which decrements the reference
  count. If this was the last reference, the node is freed.

- It then attempts to check if (!of_device_is_available(np)).

The pointer np is used after its reference has been released.
This can lead to a kernel oops or unpredictable behavior if
the memory has been reclaimed.

Fixes: fe27cce1e ("realtek: add SerDes PCS driver")
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23391
Signed-off-by: Robert Marko <robimarko@gmail.com>
This commit is contained in:
Markus Stockhausen
2026-05-15 21:42:19 +02:00
committed by Robert Marko
parent 965bfd55c2
commit 410cc636d7
1 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
target/linux/realtek/files-6.18/drivers/net/pcs/pcs-rtl-otto.c
+6 -5
View File
@@ -4143,6 +4143,12 @@ static struct mii_bus *rtpcs_probe_serdes_bus(struct rtpcs_ctrl *ctrl)
return ERR_PTR(-ENODEV);
}
if (!of_device_is_available(np)) {
dev_err(ctrl->dev, "SerDes mdio bus not usable");
of_node_put(np);
return ERR_PTR(-ENODEV);
}
bus = of_mdio_find_bus(np);
of_node_put(np);
if (!bus) {
@@ -4150,11 +4156,6 @@ static struct mii_bus *rtpcs_probe_serdes_bus(struct rtpcs_ctrl *ctrl)
return ERR_PTR(-EPROBE_DEFER);
}
if (!of_device_is_available(np)) {
dev_err(ctrl->dev, "SerDes mdio bus not usable");
return ERR_PTR(-ENODEV);
}
return bus;
}