| Message ID | 1562317260-13492-1-git-send-email-wen.yang99@zte.com.cn (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | powerpc/prom: fix use-after-free on cpu_to_chip_id() | expand |
| Context | Check | Description |
|---|---|---|
| snowpatch_ozlabs/apply_patch | success | Successfully applied on branch next (f531d5e8f55b3767217b5d1be0ce1f1acd10167c) |
| snowpatch_ozlabs/build-ppc64le | success | Build succeeded |
| snowpatch_ozlabs/build-ppc64be | success | Build succeeded |
| snowpatch_ozlabs/build-ppc64e | success | Build succeeded |
| snowpatch_ozlabs/build-pmac32 | success | Build succeeded |
| snowpatch_ozlabs/checkpatch | success | total: 0 errors, 0 warnings, 0 checks, 16 lines checked |
diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c index 7159e79..ad87b94 100644 --- a/arch/powerpc/kernel/prom.c +++ b/arch/powerpc/kernel/prom.c @@ -872,13 +872,15 @@ EXPORT_SYMBOL(of_get_ibm_chip_id); int cpu_to_chip_id(int cpu) { struct device_node *np; + int id; np = of_get_cpu_node(cpu, NULL); if (!np) return -1; + id = of_get_ibm_chip_id(np); of_node_put(np); - return of_get_ibm_chip_id(np); + return id; } EXPORT_SYMBOL(cpu_to_chip_id);
The np variable is still being used after the of_node_put() call, which may result in use-after-free. We fix this issue by calling of_node_put() after the last usage. Fixes: 3eb906c6b6c1 ("powerpc: Make cpu_to_chip_id() available when SMP=n") Signed-off-by: Wen Yang <wen.yang99@zte.com.cn> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Paul Mackerras <paulus@samba.org> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Christophe Leroy <christophe.leroy@c-s.fr> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Mike Rapoport <rppt@linux.vnet.ibm.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.ibm.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: linuxppc-dev@lists.ozlabs.org Cc: linux-kernel@vger.kernel.org --- arch/powerpc/kernel/prom.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)