Commit c1959066 authored Feb 04, 2019 by Dan Carpenter Committed by Li Yang Feb 04, 2019

soc: fsl: dpio: Use after free in dpaa2_dpio_remove()



The dpaa2_io_down(priv->io) call frees "priv->io" so I've shifted the
code around a little bit to avoid the use after free.

Fixes: 991e8732 ("soc: fsl: dpio: use a cpumask to identify which cpus are unused")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Li Yang <leoyang.li@nxp.com>

parent 3c0d64e8

drivers/soc/fsl/dpio/dpio-driver.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -220,12 +220,12 @@ static int dpaa2_dpio_remove(struct fsl_mc_device *dpio_dev)

		dev = &dpio_dev->dev;
		priv = dev_get_drvdata(dev);
		cpu = dpaa2_io_get_cpu(priv->io);

		dpaa2_io_down(priv->io);

		dpio_teardown_irqs(dpio_dev);

		cpu = dpaa2_io_get_cpu(priv->io);
		cpumask_set_cpu(cpu, cpus_unused_mask);

		err = dpio_open(dpio_dev->mc_io, 0, dpio_dev->obj_desc.id,