Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 330b7094 authored by Alexey Khoroshilov's avatar Alexey Khoroshilov Committed by Greg Kroah-Hartman
Browse files

clk: renesas: cpg-mssr: Fix use after free if cpg_mssr_common_init() failed 



[ Upstream commit fbfd614aeaa2853c2c575299dfe2458db8eff67e ]

If cpg_mssr_common_init() fails after assigning priv to global variable
cpg_mssr_priv, it deallocates priv, but cpg_mssr_priv keeps dangling
pointer that potentially can be used later.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 1f7db7bb ("clk: renesas: cpg-mssr: Add early clock support")
Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Reviewed-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/1671806417-32623-1-git-send-email-khoroshilov@ispras.ru


Signed-off-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent f34eb1e4

drivers/clk/renesas/renesas-cpg-mssr.c

+2 −1
Original line number Diff line number Diff line
@@ -907,7 +907,6 @@ static int __init cpg_mssr_common_init(struct device *dev, 
		goto out_err;

	}



	cpg_mssr_priv = priv;

	priv->num_core_clks = info->num_total_core_clks;

	priv->num_mod_clks = info->num_hw_mod_clks;

	priv->last_dt_core_clk = info->last_dt_core_clk;
@@ -921,6 +920,8 @@ static int __init cpg_mssr_common_init(struct device *dev, 
	if (error)

		goto out_err;



	cpg_mssr_priv = priv;



	return 0;



out_err: