Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e9f2a856 authored by Wen Yang's avatar Wen Yang Committed by Marc Kleine-Budde
Browse files

can: flexcan: fix an use-after-free in flexcan_setup_stop_mode() 



The gpr_np variable is still being used in dev_dbg() after the
of_node_put() call, which may result in use-after-free.

Fixes: de3578c1 ("can: flexcan: add self wakeup support")
Signed-off-by: default avatarWen Yang <wen.yang99@zte.com.cn>
Cc: linux-stable <stable@vger.kernel.org> # >= v5.0
Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
parent 375f7558

drivers/net/can/flexcan.c

+5 −3
Original line number Diff line number Diff line
@@ -1437,10 +1437,10 @@ static int flexcan_setup_stop_mode(struct platform_device *pdev) 


	priv = netdev_priv(dev);

	priv->stm.gpr = syscon_node_to_regmap(gpr_np);

	of_node_put(gpr_np);

	if (IS_ERR(priv->stm.gpr)) {

		dev_dbg(&pdev->dev, "could not find gpr regmap\n");

		return PTR_ERR(priv->stm.gpr);

		ret = PTR_ERR(priv->stm.gpr);

		goto out_put_node;

	}



	priv->stm.req_gpr = out_val[1];
@@ -1455,7 +1455,9 @@ static int flexcan_setup_stop_mode(struct platform_device *pdev) 


	device_set_wakeup_capable(&pdev->dev, true);



	return 0;

out_put_node:

	of_node_put(gpr_np);

	return ret;

}



static const struct of_device_id flexcan_of_match[] = {