lkml.org 
[lkml]   [2019]   [Aug]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.2 090/144] cpufreq/pasemi: fix use-after-free in pas_cpufreq_cpu_init()
    Date
    [ Upstream commit e0a12445d1cb186d875410d093a00d215bec6a89 ]

    The cpu variable is still being used in the of_get_property() call
    after the of_node_put() call, which may result in use-after-free.

    Fixes: a9acc26b75f6 ("cpufreq/pasemi: fix possible object reference leak")
    Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
    Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/cpufreq/pasemi-cpufreq.c | 23 +++++++++--------------
    1 file changed, 9 insertions(+), 14 deletions(-)

    diff --git a/drivers/cpufreq/pasemi-cpufreq.c b/drivers/cpufreq/pasemi-cpufreq.c
    index 6b1e4abe32483..d2f061015323d 100644
    --- a/drivers/cpufreq/pasemi-cpufreq.c
    +++ b/drivers/cpufreq/pasemi-cpufreq.c
    @@ -131,10 +131,18 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy)
    int err = -ENODEV;

    cpu = of_get_cpu_node(policy->cpu, NULL);
    + if (!cpu)
    + goto out;

    + max_freqp = of_get_property(cpu, "clock-frequency", NULL);
    of_node_put(cpu);
    - if (!cpu)
    + if (!max_freqp) {
    + err = -EINVAL;
    goto out;
    + }
    +
    + /* we need the freq in kHz */
    + max_freq = *max_freqp / 1000;

    dn = of_find_compatible_node(NULL, NULL, "1682m-sdc");
    if (!dn)
    @@ -171,16 +179,6 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy)
    }

    pr_debug("init cpufreq on CPU %d\n", policy->cpu);
    -
    - max_freqp = of_get_property(cpu, "clock-frequency", NULL);
    - if (!max_freqp) {
    - err = -EINVAL;
    - goto out_unmap_sdcpwr;
    - }
    -
    - /* we need the freq in kHz */
    - max_freq = *max_freqp / 1000;
    -
    pr_debug("max clock-frequency is at %u kHz\n", max_freq);
    pr_debug("initializing frequency table\n");

    @@ -198,9 +196,6 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy)

    return cpufreq_generic_init(policy, pas_freqs, get_gizmo_latency());

    -out_unmap_sdcpwr:
    - iounmap(sdcpwr_mapbase);
    -
    out_unmap_sdcasr:
    iounmap(sdcasr_mapbase);
    out:
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-08-14 19:26    [W:8.509 / U:0.088 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site