Re: [PATCH] mtd: rawnand: tegra: fix OF node leak in tegra_nand_chips_init()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] mtd: rawnand: tegra: UAF due to premature of_node_put() before registration
--

commit 1cf3654f6b317262348cbad1bbf461282840058e
Author: Haotian Zhang <vulab@iscas.ac.cn>

mtd: rawnand: tegra: fix OF node leak in tegra_nand_chips_init()

This commit attempts to fix a device node leak by releasing np_nand right
after calling nand_set_flash_node().

> diff --git a/drivers/mtd/nand/raw/tegra_nand.c b/drivers/mtd/nand/raw/tegra_nand.c
> --- a/drivers/mtd/nand/raw/tegra_nand.c
> +++ b/drivers/mtd/nand/raw/tegra_nand.c
[ ... ]
> @@ -1119,6 +1122,7 @@ static int tegra_nand_chips_init(struct device *dev,
>  	mtd->owner = THIS_MODULE;
>  
>  	nand_set_flash_node(chip, np_nand);
> +	of_node_put(np_nand);

[Severity: High]
Does this introduce a use-after-free risk for the device node?

The nand_set_flash_node() helper stores the pointer in mtd->dev.of_node
but does not increment its reference count. By dropping the reference here,
could the node be freed before subsequent accesses?

Later in this function, nand_scan() dereferences this flash node to read 
properties:

drivers/mtd/nand/raw/nand_base.c:of_get_nand_bus_width() {
    struct device_node *dn = nand_get_flash_node(chip);
    ...
    ret = of_property_read_u32(dn, "nand-bus-width", &val);
    ...
}

Furthermore, mtd_device_register() will also access the node to increment
its refcount:

drivers/mtd/mtdcore.c:add_mtd_device() {
    ...
    mtd_check_of_node(mtd);
    of_node_get(mtd_get_of_node(mtd));
    ...
}

If dynamic DT unloading drops the final reference before
mtd_device_register() completes, it appears these later calls might access
freed memory.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261008182442.2770036-1-vulab@iscas.ac.cn?part=1