Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 746b6d4c authored by Mulu He's avatar Mulu He Committed by Gerrit - the friendly Code Review server
Browse files

coresight: stm: Fix null point issue in stm 



use-after-free over the global variable .stmdrvdata cause NULL point crash.
stm_register_device call fail will be deferred probe, this action will
release all devm_** managed resource, so the preset stm_set_ost_params
will be cleared, in this case, if any call function use the global
.stmdrvdata variable will cause problem.

Change-Id: I8b287389f47c0b131f26ff00eef3f4c1bb7e63cd
Signed-off-by: default avatarMulu He <muluhe@codeaurora.org>
parent 2c6fd882

drivers/hwtracing/coresight/coresight-stm.c

+6 −6
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

/*

 * Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.

 * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.

 *

 * Description: CoreSight System Trace Macrocell driver

 *
@@ -866,11 +866,6 @@ static int stm_probe(struct amba_device *adev, const struct amba_id *id) 
				 BYTES_PER_CHANNEL), resource_size(res));

	}

	bitmap_size = BITS_TO_LONGS(drvdata->numsp) * sizeof(long);

	/* Store the driver data pointer for use in exported functions */

	ret = stm_set_ost_params(drvdata, bitmap_size);

	if (ret)

		return ret;





	guaranteed = devm_kzalloc(dev, bitmap_size, GFP_KERNEL);

	if (!guaranteed)
@@ -900,6 +895,11 @@ static int stm_probe(struct amba_device *adev, const struct amba_id *id) 
		goto stm_unregister;

	}



	/* Store the driver data pointer for use in exported functions */

	ret = stm_set_ost_params(drvdata, bitmap_size);

	if (ret)

		goto stm_unregister;



	pm_runtime_put(&adev->dev);



	dev_info(dev, "%s initialized with master %s\n", (char *)id->data,