Re: [PATCH] cpufreq/pasemi: fix an use-after-free in pas_cpufreq_cpu_init()
flat view
From: Viresh Kumar <viresh.kumar@linaro.org>
Date: 2019-07-08 06:27:13
Also in:
linux-pm, lkml
On 08-07-19, 14:19, Wen Yang wrote:
The cpu variable is still being used in the of_get_property() call
after the of_node_put() call, which may result in use-after-free.
Fixes: a9acc26b75f ("cpufreq/pasemi: fix possible object reference leak")
Signed-off-by: Wen Yang <redacted>
Cc: "Rafael J. Wysocki" <redacted>
Cc: Viresh Kumar <viresh.kumar@linaro.org>
Cc: linuxppc-dev@lists.ozlabs.org
Cc: linux-pm@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
---
drivers/cpufreq/pasemi-cpufreq.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)I will suggest some changes here.
quoted hunk ↗ jump to hunk
diff --git a/drivers/cpufreq/pasemi-cpufreq.c b/drivers/cpufreq/pasemi-cpufreq.c index 6b1e4ab..d2dd47b 100644 --- a/drivers/cpufreq/pasemi-cpufreq.c +++ b/drivers/cpufreq/pasemi-cpufreq.c@@ -132,7 +132,6 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy)
Don't initialize "err" anymore.
quoted hunk ↗ jump to hunk
cpu = of_get_cpu_node(policy->cpu, NULL); - of_node_put(cpu); if (!cpu) goto out;
Do return -ENODEV; here.
quoted hunk ↗ jump to hunk
@@ -141,15 +140,15 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy) dn = of_find_compatible_node(NULL, NULL, "pasemi,pwrficient-sdc"); if (!dn) - goto out; + goto out_put_cpu_node; err = of_address_to_resource(dn, 0, &res); of_node_put(dn); if (err) - goto out; + goto out_put_cpu_node; sdcasr_mapbase = ioremap(res.start + SDCASR_OFFSET, 0x2000); if (!sdcasr_mapbase) { err = -EINVAL; - goto out; + goto out_put_cpu_node; }
Don't do above changes.
quoted hunk ↗ jump to hunk
dn = of_find_compatible_node(NULL, NULL, "1682m-gizmo");@@ -177,6 +176,7 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy) err = -EINVAL; goto out_unmap_sdcpwr; } + of_node_put(cpu); /* we need the freq in kHz */ max_freq = *max_freqp / 1000;@@ -203,6 +203,8 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy) out_unmap_sdcasr: iounmap(sdcasr_mapbase); +out_put_cpu_node:
Don't add this label, instead use "out" for also having the below code.
+ of_node_put(cpu); out: return err; } -- 2.9.5
-- viresh