Skip to contentSkip to conversation

soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node

PATCH In review Krzysztof Kozlowski 1 participant 2 messages Sep 17

Subsystems (2)
Stable branch Arm Samsung Exynos
lore
Share & tools
lore

Krzysztof Kozlowski

author maintainer
#0 lore raw

PATCH 1/1 soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node

From: Alexey Klimov <[email protected]>

The setup_cpuhp_and_cpuidle() parses the device tree node for the interrupt generation block via of_parse_phandle() and decrements its reference count using of_node_put() immediately after fetching the resource address. However, later the intr_gen_node pointer is passed into of_syscon_register_regmap().

Fix this by declaring intr_gen_node with __free() and removing of_node_put().

Reported-by Sashiko <[email protected]>
Closes https://sashiko.dev/#/patchset/[email protected]?part=3
Fixes 78b72897a5c8 ("soc: samsung: exynos-pmu: Enable CPU Idle for gs101")
Cc [email protected]
Signed-off-by Alexey Klimov <[email protected]>
Link https://patch.msgid.link/20260828-exynos-pmu-cpuhp-idle-fixes-v2-1-06bce6107bd6@linaro.org open here
Signed-off-by Krzysztof Kozlowski <[email protected]>
---
 drivers/soc/samsung/exynos-pmu.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/soc/samsung/exynos-pmu.c +2 -5
index f5fcdde9750e..efccdd63e40e 100644
@@ -409,13 +409,12 @@ static struct notifier_block exynos_cpupm_reboot_nb = {
 
 static int setup_cpuhp_and_cpuidle(struct device *dev)
 {
-	struct device_node *intr_gen_node;
+	struct device_node *intr_gen_node __free(device_node) =
+		of_parse_phandle(dev->of_node, "google,pmu-intr-gen-syscon", 0);
 	struct resource intrgen_res;
 	void __iomem *virt_addr;
 	int ret, cpu;
 
-	intr_gen_node = of_parse_phandle(dev->of_node,
-					 "google,pmu-intr-gen-syscon", 0);
 	if (!intr_gen_node) {
 		/*
 		 * To maintain support for older DTs that didn't specify syscon

@@ -431,8 +430,6 @@ static int setup_cpuhp_and_cpuidle(struct device *dev)
 	 * syscon provided regmap.
 	 */
 	ret = of_address_to_resource(intr_gen_node, 0, &intrgen_res);
-	of_node_put(intr_gen_node);
-
 	virt_addr = devm_ioremap(dev, intrgen_res.start,
 				 resource_size(&intrgen_res));
 	if (!virt_addr)
Signature · 1 line
2.53.0
author maintainer
#1 lore raw
Quoted 18 lines · Krzysztof Kozlowski

From: Alexey Klimov <[email protected]>

The setup_cpuhp_and_cpuidle() parses the device tree node for the interrupt generation block via of_parse_phandle() and decrements its reference count using of_node_put() immediately after fetching the resource address. However, later the intr_gen_node pointer is passed into of_syscon_register_regmap().

Fix this by declaring intr_gen_node with __free() and removing of_node_put().

Reported-by Sashiko <[email protected]>
Closes https://sashiko.dev/#/patchset/[email protected]?part=3
Fixes 78b72897a5c8 ("soc: samsung: exynos-pmu: Enable CPU Idle for gs101")
Cc [email protected]
Signed-off-by Alexey Klimov <[email protected]>
Link https://patch.msgid.link/20260828-exynos-pmu-cpuhp-idle-fixes-v2-1-06bce6107bd6@linaro.org open here
Signed-off-by Krzysztof Kozlowski <[email protected]>
Quoted 2 lines
---
 drivers/soc/samsung/exynos-pmu.c | 7 ++-----

Please ignore, brain fart.

Best regards,
Krzysztof