From patchwork Sun Jan 30 15:25:02 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexander Sverdlin X-Patchwork-Id: 12729871 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 427CDC433F5 for ; Sun, 30 Jan 2022 15:28:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:Cc :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=0FCNRBdz56RTHRavIivtjRtGH8Q1oFnco5z4Iy3aGZs=; b=v1xyvkPTA9Y5Rj AqUyiD2uvwT3HfNIvVgrDQcM/+QRpEvVWxGXE93o+Mcn8jX7R5bObgkQJGaVzpq1ecIl9gXMOwbHE xPeo86swhAvBBPwKAQe9J5K6bKcqAvYQcJlLx9+yy/nFDaGIIDFXzLtRfGr2ZBckH2JvzzeRU61DD Il3M4JLjyswLpFsQEFVW/0ufohqngbWOwKgRJ8HDN+DUeudbiw8o+YaAOi/s4r8LVy6424JypaUp2 06PATHPV5+oyKMGg8EIR5yxDNq0gH/QCkzEZ3y0ZWrEA6CJUn0AqoIhq9hCDl+YaAMHUySQrQa+MC L+aWGenRsjryFxcAQrCg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1nEC6y-006sWT-Rg; Sun, 30 Jan 2022 15:27:29 +0000 Received: from mail-wm1-x32f.google.com ([2a00:1450:4864:20::32f]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1nEC6v-006sVm-4x for linux-arm-kernel@lists.infradead.org; Sun, 30 Jan 2022 15:27:26 +0000 Received: by mail-wm1-x32f.google.com with SMTP id i187-20020a1c3bc4000000b0034d2ed1be2aso11980874wma.1 for ; Sun, 30 Jan 2022 07:27:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=M0F+HzCmfFkZhhA5GVZSk7LS0FRyBdrUMs+hALno+og=; b=HHH4AjpTv8Dw7eKZmrdJJqAKeEvQW3gjfra/tFHN2EzVsGB5vgB9PDUrwdhsq3yeQS swwE6CWvjOG5oPntOl2fG04zLhKbmfvFnZJpiCGQB3+qJsM6WS7sWn6WEF94hi7YI2N9 c+3Jt5c+IVclsUFFbNznJZQF8J/na1I9Yt87uWAow/BpliPWnw+nNuc/Y0f4IlbLffir 0TAgsiiaDgqaayi8MGXSIwmEqU2Kkv/pPMwprRFGSx9MNau3nykRDZsa+dhhy8UWHQpV XSHvIdOixgflew0M6Apa2xfNb+yVOEWyJ1hQNGVlkYvFS3DHJVeJhcxKZId5Zg8QvbsV pN0Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=M0F+HzCmfFkZhhA5GVZSk7LS0FRyBdrUMs+hALno+og=; b=nDeFvk1LNF5srO9b1yy+IopLEHorc8cFDt0cOpJRpeWrPNed+pSP9a1Z8En+DLB2zD oeOmaoBYYojMbcNtlEOkI6XF2Zt+xj1Yli97BSd1JEm+iVSjvZFY5ib+vXTj7CfpwOL6 Dzfwej2qej7g3TcdcgZkyZ3CkIIZ2t8PFlHAB85M2TTssokzbP/kSx+a2KHa8/RfsPxa YJjhC5XIOaysD8Mdrr2iycu0gzguVw+8C99K1q4M2ArshIqMOdGM8lKyZREy1t/bINRt iZlxM4/WhC9JLCTX1+2TIaJDF1OnH9IihFt1U5qo2Oq8pYyyZw5fWSzHtQS3XR3ISvr+ U0vw== X-Gm-Message-State: AOAM531jVI8FcPFh85pmuqIBMTJ721wZW4908VEVfxABaYCMH8tHftUt bFwptBdZyG+anMgJ4H5i7OmtMMmkiFvABw== X-Google-Smtp-Source: ABdhPJzlQoKGNrSZe/aJNh2YZSd7efE3HmJEbXmeg+HInoCCF6VtWJp/rJQaZd77rIekxd6/ddYWUQ== X-Received: by 2002:a1c:1f0c:: with SMTP id f12mr14939908wmf.44.1643556443067; Sun, 30 Jan 2022 07:27:23 -0800 (PST) Received: from localhost.localdomain ([195.245.21.30]) by smtp.gmail.com with ESMTPSA id n11sm7477781wms.3.2022.01.30.07.27.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 30 Jan 2022 07:27:22 -0800 (PST) From: Alexander Sverdlin To: linux-arm-kernel@lists.infradead.org Cc: Alexander Sverdlin , Hartley Sweeten , Russell King , Nikita Shubin , Arnd Bergmann , linux-kernel@vger.kernel.org, Nick Desaulniers , kernel test robot , stable@vger.kernel.org Subject: [PATCH v2] ep93xx: clock: Fix UAF in ep93xx_clk_register_gate() Date: Sun, 30 Jan 2022 16:25:02 +0100 Message-Id: <20220130152502.236531-1-alexander.sverdlin@gmail.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220130_072725_218449_0A199209 X-CRM114-Status: GOOD ( 13.42 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org arch/arm/mach-ep93xx/clock.c:154:2: warning: Use of memory after it is freed [clang-analyzer-unix.Malloc] arch/arm/mach-ep93xx/clock.c:151:2: note: Taking true branch if (IS_ERR(clk)) ^ arch/arm/mach-ep93xx/clock.c:152:3: note: Memory is released kfree(psc); ^~~~~~~~~~ arch/arm/mach-ep93xx/clock.c:154:2: note: Use of memory after it is freed return &psc->hw; ^ ~~~~~~~~ Link: https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org/thread/B5YCO2NJEXINCYE26Y255LCVMO55BGWW/ Reported-by: kernel test robot Fixes: 9645ccc7bd7a ("ep93xx: clock: convert in-place to COMMON_CLK") Cc: stable@vger.kernel.org Signed-off-by: Alexander Sverdlin --- Changelog: v2: - Thanks to Nick for the hint to use ERR_CAST() arch/arm/mach-ep93xx/clock.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/arm/mach-ep93xx/clock.c b/arch/arm/mach-ep93xx/clock.c index cc75087134d3..4aee14f18123 100644 --- a/arch/arm/mach-ep93xx/clock.c +++ b/arch/arm/mach-ep93xx/clock.c @@ -148,8 +148,10 @@ static struct clk_hw *ep93xx_clk_register_gate(const char *name, psc->lock = &clk_lock; clk = clk_register(NULL, &psc->hw); - if (IS_ERR(clk)) + if (IS_ERR(clk)) { kfree(psc); + return ERR_CAST(clk); + } return &psc->hw; }