From patchwork Fri Apr 27 14:06:49 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 10368919 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 07539602DC for ; Fri, 27 Apr 2018 14:17:08 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E94DC29342 for ; Fri, 27 Apr 2018 14:17:07 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id DDAB72934B; Fri, 27 Apr 2018 14:17:07 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, MAILING_LIST_MULTI, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 646DA29349 for ; Fri, 27 Apr 2018 14:17:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Subject:To:From :Date:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=y0cCHwf7z9qN6OwK6oW7cKHQY/NtskT9j2tC5wqC9wk=; b=u6fSqKkMoQh8of uSzZ1MSFnIw6ptgnlqMJH3mz4MxVe9dj4MPrDsj84VV9jWm8pnb4pr/K4NKLpHBaVwBA49IdYerRA yW7ZxxUrzHS/SCAyjcNIUlnzx4uCKIB7O+YgS6CKPg68SU1JAVeFHmxgT2g/EWQh/nMqSCI8hZ/ga W7XJAfVrof6CObstL4xdTl9pMJggj49OBwiOx7LCmwkXEQMz7zaxUwhJxiRsZAKK22eaXqRKpHi8h UcCfOaYGQbdnlO/XRHSnNSatr/+oPP3tGU5M/aF4TYfQfCQ+hIOtbRfptlDwc4eOmRkJtWfQTsz09 ckdol+D3brd+tgzxh5lw==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1fC4BK-0002gt-Rw; Fri, 27 Apr 2018 14:17:02 +0000 Received: from aserp2120.oracle.com ([141.146.126.78]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1fC41p-0004vA-W7 for linux-arm-kernel@lists.infradead.org; Fri, 27 Apr 2018 14:07:24 +0000 Received: from pps.filterd (aserp2120.oracle.com [127.0.0.1]) by aserp2120.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w3RE6OWE054972; Fri, 27 Apr 2018 14:06:57 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=date : from : to : cc : subject : message-id : mime-version : content-type; s=corp-2017-10-26; bh=H98vSQMnKPVhW36cQL4H2JY6e2p7rnGf8qZOZyoNf+Q=; b=f+m5T85UBUfd3h4fiFd8vUgmsK88+5imDAVaOM2XsVoun+iWStK6rJqQ++OVdyWt7Ht2 v2Y+L/fyKmRlKTSkz625ZRjohzaNeqQRQ9eG5LkBTaSxBxyx5uKqj94oJMmLEcOQ2rz3 voV/864AwJDK7LxmulJZQK9YKhNQPHN1EKnOtx98fdPX2Alh+GwLOL5qHT+JPaMYCs7U 9WgqsF7hZ3nI8YVzQNhIEvi+wfoAIxU+dUGw4+Yh41b9YZRxq4gfsqLV7V3vgom0YE/f aO45RRN2Q+n+H9q1cSBd5WtQyqviUBKeqA8Jx6tuVXrICdYFpzf0brtxHtBGs2QpycVD eg== Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by aserp2120.oracle.com with ESMTP id 2hfw9aqq38-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 27 Apr 2018 14:06:57 +0000 Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id w3RE6uhb014495 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 27 Apr 2018 14:06:56 GMT Received: from abhmp0011.oracle.com (abhmp0011.oracle.com [141.146.116.17]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id w3RE6t8Y013487; Fri, 27 Apr 2018 14:06:56 GMT Received: from mwanda (/197.254.35.146) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 27 Apr 2018 07:06:55 -0700 Date: Fri, 27 Apr 2018 17:06:49 +0300 From: Dan Carpenter To: Sudeep Holla Subject: [PATCH] firmware: arm_scmi: Use after free in scmi_create_protocol_device() Message-ID: <20180427140649.GD19583@mwanda> MIME-Version: 1.0 Content-Disposition: inline X-Mailer: git-send-email haha only kidding User-Agent: Mutt/1.9.4 (2018-02-28) X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=8875 signatures=668698 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=500 adultscore=7 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1804270136 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180427_070714_175798_033CFFF0 X-CRM114-Status: GOOD ( 12.21 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: kernel-janitors@vger.kernel.org, linux-arm-kernel@lists.infradead.org Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP We need to return here instead of setting up the freed sdev device as a transport. Fixes: 907b6d14911d ("firmware: arm_scmi: add per-protocol channels support using idr objects") Signed-off-by: Dan Carpenter diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c index 14b147135a0c..2455be8cbc4f 100644 --- a/drivers/firmware/arm_scmi/driver.c +++ b/drivers/firmware/arm_scmi/driver.c @@ -778,6 +778,7 @@ scmi_create_protocol_device(struct device_node *np, struct scmi_info *info, if (scmi_mbox_chan_setup(info, &sdev->dev, prot_id)) { dev_err(&sdev->dev, "failed to setup transport\n"); scmi_device_destroy(sdev); + return; } /* setup handle now as the transport is ready */