iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

of: dynamic: Fix race in getting old property when updating property

Browse Source 
__of_update_property() returns the existing property if there is one, but
that value is never added to the changeset. Updates work because the
existing property was also retrieved before in of_changeset_action(),
but that is racy as of_changeset_action() doesn't hold any locks. The
property could be changed before the changeset is applied.

Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/20230801-dt-changeset-fixes-v3-4-5f0410e007dd@kernel.org
Signed-off-by: Rob Herring <robh@kernel.org>
This commit is contained in:
Rob Herring 2023-08-18 15:40:59 -05:00
parent 27a02f265e
commit 420f0de965
1 changed files with 2 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/of/dynamic.c
View File

@ -564,7 +564,7 @@ static int __of_changeset_entry_notify(struct of_changeset_entry *ce,
static int __of_changeset_entry_apply(struct of_changeset_entry *ce) static int __of_changeset_entry_apply(struct of_changeset_entry *ce)
{ {
struct property *old_prop, **propp; struct property **propp;
unsigned long flags; unsigned long flags;
int ret = 0; int ret = 0;
@ -604,7 +604,7 @@ static int __of_changeset_entry_apply(struct of_changeset_entry *ce)
} }
} }
ret = __of_update_property(ce->np, ce->prop, &old_prop); ret = __of_update_property(ce->np, ce->prop, &ce->old_prop);
break; break;
default: default:
ret = -EINVAL; ret = -EINVAL;
@ -908,9 +908,6 @@ int of_changeset_action(struct of_changeset *ocs, unsigned long action,
ce->np = of_node_get(np); ce->np = of_node_get(np);
ce->prop = prop; ce->prop = prop;
if (action == OF_RECONFIG_UPDATE_PROPERTY && prop)
ce->old_prop = of_find_property(np, prop->name, NULL);
/* add it to the list */ /* add it to the list */
list_add_tail(&ce->node, &ocs->entries); list_add_tail(&ce->node, &ocs->entries);
return 0; return 0;