| Message ID | 1671806417-32623-1-git-send-email-khoroshilov@ispras.ru (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Geert Uytterhoeven |
| Headers | show |
| Series | [v2] clk: renesas: cpg-mssr: Fix use after free if cpg_mssr_common_init() failed | expand |
On Fri, Dec 23, 2022 at 3:40 PM Alexey Khoroshilov <khoroshilov@ispras.ru> wrote: > If cpg_mssr_common_init() fails after assigning priv to global variable > cpg_mssr_priv, it deallocates priv, but cpg_mssr_priv keeps dangling > pointer that potentially can be used later. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: 1f7db7bbf031 ("clk: renesas: cpg-mssr: Add early clock support") > Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> > --- > v2: Move cpg_mssr_priv assignment just before return 0; instead of > clearing it as Geert Uytterhoeven <geert@linux-m68k.org> suggested. Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> i.e. will queue in renesas-clk-for-v6.3. Gr{oetje,eeting}s, Geert -- Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org In personal conversations with technical people, I call myself a hacker. But when I'm talking to journalists I just say "programmer" or something like that. -- Linus Torvalds
diff --git a/drivers/clk/renesas/renesas-cpg-mssr.c b/drivers/clk/renesas/renesas-cpg-mssr.c index 1a0cdf001b2f..5dce9779324d 100644 --- a/drivers/clk/renesas/renesas-cpg-mssr.c +++ b/drivers/clk/renesas/renesas-cpg-mssr.c @@ -989,7 +989,6 @@ static int __init cpg_mssr_common_init(struct device *dev, goto out_err; } - cpg_mssr_priv = priv; priv->num_core_clks = info->num_total_core_clks; priv->num_mod_clks = info->num_hw_mod_clks; priv->last_dt_core_clk = info->last_dt_core_clk; @@ -1019,6 +1018,8 @@ static int __init cpg_mssr_common_init(struct device *dev, if (error) goto out_err; + cpg_mssr_priv = priv; + return 0; out_err:
If cpg_mssr_common_init() fails after assigning priv to global variable cpg_mssr_priv, it deallocates priv, but cpg_mssr_priv keeps dangling pointer that potentially can be used later. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 1f7db7bbf031 ("clk: renesas: cpg-mssr: Add early clock support") Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> --- v2: Move cpg_mssr_priv assignment just before return 0; instead of clearing it as Geert Uytterhoeven <geert@linux-m68k.org> suggested. drivers/clk/renesas/renesas-cpg-mssr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)