Skip to contentSkip to conversation

cpufreq: scmi: fix use-after-free in scmi_cpufreq_exit()

PATCH In review Yangtao Li 4 participants 4 messages Feb 16, 2019 – Feb 19, 2019

Subsystems (2)
CPU frequency scaling framework System control & power/management interface (SCPI/SCMI) Message Protocol drivers
lore
Share & tools
lore

Yangtao Li

author
#0 lore raw

PATCH 1/1 cpufreq: scmi: fix use-after-free in scmi_cpufreq_exit()

This issue was detected with the help of Coccinelle. So change the order of function calls to fix it.

Fixes 1690d8bb91e37 (cpufreq: scpi/scmi: Fix freeing of dynamic OPPs)
Signed-off-by Yangtao Li <[email protected]>
---
 drivers/cpufreq/scmi-cpufreq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cpufreq/scmi-cpufreq.c +1 -1
index 242c3370544e..9ed46d188cb5 100644
@@ -187,8 +187,8 @@ static int scmi_cpufreq_exit(struct cpufreq_policy *policy)
 
 	cpufreq_cooling_unregister(priv->cdev);
 	dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table);
-	kfree(priv);
 	dev_pm_opp_remove_all_dynamic(priv->cpu_dev);
+	kfree(priv);
 
 	return 0;
 }
Signature · 1 line
2.17.0
maintainer Acked-by on v1 1/1
#1 lore raw
Quoted 15 lines · Yangtao Li

This issue was detected with the help of Coccinelle. So change the order of function calls to fix it.

Fixes 1690d8bb91e37 (cpufreq: scpi/scmi: Fix freeing of dynamic OPPs)
Signed-off-by Yangtao Li <[email protected]>
---
 drivers/cpufreq/scmi-cpufreq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cpufreq/scmi-cpufreq.c +0 -0
index 242c3370544e..9ed46d188cb5 100644

drivers/cpufreq/scmi-cpufreq.c static int scmi_cpufreq_exit(struct cpufreq_policy *policy) · line 194

Quoted 9 lines
drivers/cpufreq/scmi-cpufreq.c +1 -1
@@ -187,8 +187,8 @@ static int scmi_cpufreq_exit(struct cpufreq_policy *policy)
 
 	cpufreq_cooling_unregister(priv->cdev);
 	dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table);
-	kfree(priv);
 	dev_pm_opp_remove_all_dynamic(priv->cpu_dev);
+	kfree(priv);
 
 	return 0;
 }
Acked-by Viresh Kumar <[email protected]>

@Rafael: Please pick it up for 5.0-rc8 as the bug was introduced during 5.0 cycle only.

The patch it fixes had this tag:

    Cc: 4.20 <[email protected]> # v4.20

And so will get applied to 4.20.N, I guess we need to mark this patch as well for stable then.

Signature · 1 line
viresh
#2 lore raw
Quoted 31 lines · CET Viresh Kumar
Quoted 15 lines · Yangtao Li

This issue was detected with the help of Coccinelle. So change the order of function calls to fix it.

Fixes 1690d8bb91e37 (cpufreq: scpi/scmi: Fix freeing of dynamic OPPs)
Signed-off-by Yangtao Li <[email protected]>
---
 drivers/cpufreq/scmi-cpufreq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cpufreq/scmi-cpufreq.c +0 -0
index 242c3370544e..9ed46d188cb5 100644

drivers/cpufreq/scmi-cpufreq.c static int scmi_cpufreq_exit(struct cpufreq_policy *policy) · line 194

Quoted 9 lines
drivers/cpufreq/scmi-cpufreq.c +1 -1
@@ -187,8 +187,8 @@ static int scmi_cpufreq_exit(struct cpufreq_policy *policy)
 
 	cpufreq_cooling_unregister(priv->cdev);
 	dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table);
-	kfree(priv);
 	dev_pm_opp_remove_all_dynamic(priv->cpu_dev);
+	kfree(priv);
 
 	return 0;
 }
Acked-by Viresh Kumar <[email protected]>

@Rafael: Please pick it up for 5.0-rc8 as the bug was introduced during 5.0 cycle only.

Quoted 6 lines

The patch it fixes had this tag:

    Cc: 4.20 <[email protected]> # v4.20

And so will get applied to 4.20.N, I guess we need to mark this patch as well for stable then.

Done now, thanks!