Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8729fe83 authored by Wen Yang's avatar Wen Yang Committed by Greg Kroah-Hartman
Browse files

cpufreq/pasemi: fix use-after-free in pas_cpufreq_cpu_init() 



[ Upstream commit e0a12445d1cb186d875410d093a00d215bec6a89 ]

The cpu variable is still being used in the of_get_property() call
after the of_node_put() call, which may result in use-after-free.

Fixes: a9acc26b75f6 ("cpufreq/pasemi: fix possible object reference leak")
Signed-off-by: default avatarWen Yang <wen.yang99@zte.com.cn>
Acked-by: default avatarViresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 991c4756

drivers/cpufreq/pasemi-cpufreq.c

+9 −14
Original line number Diff line number Diff line
@@ -145,10 +145,18 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy) 
	int err = -ENODEV;



	cpu = of_get_cpu_node(policy->cpu, NULL);

	if (!cpu)

		goto out;



	max_freqp = of_get_property(cpu, "clock-frequency", NULL);

	of_node_put(cpu);

	if (!cpu)

	if (!max_freqp) {

		err = -EINVAL;

		goto out;

	}



	/* we need the freq in kHz */

	max_freq = *max_freqp / 1000;



	dn = of_find_compatible_node(NULL, NULL, "1682m-sdc");

	if (!dn)
@@ -185,16 +193,6 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy) 
	}



	pr_debug("init cpufreq on CPU %d\n", policy->cpu);



	max_freqp = of_get_property(cpu, "clock-frequency", NULL);

	if (!max_freqp) {

		err = -EINVAL;

		goto out_unmap_sdcpwr;

	}



	/* we need the freq in kHz */

	max_freq = *max_freqp / 1000;



	pr_debug("max clock-frequency is at %u kHz\n", max_freq);

	pr_debug("initializing frequency table\n");
@@ -212,9 +210,6 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy) 


	return cpufreq_generic_init(policy, pas_freqs, get_gizmo_latency());



out_unmap_sdcpwr:

	iounmap(sdcpwr_mapbase);



out_unmap_sdcasr:

	iounmap(sdcasr_mapbase);

out: