The np variable is still being used after the of_node_put() call, which may result in use-after-free. We fix this issue by calling of_node_put() after the last usage.
Fixes: 3eb906c6b6c1 ("powerpc: Make cpu_to_chip_id() available when SMP=n") Signed-off-by: Wen Yang <wen.yan...@zte.com.cn> Cc: Benjamin Herrenschmidt <b...@kernel.crashing.org> Cc: Paul Mackerras <pau...@samba.org> Cc: Michael Ellerman <m...@ellerman.id.au> Cc: Christophe Leroy <christophe.le...@c-s.fr> Cc: Andrew Morton <a...@linux-foundation.org> Cc: Mike Rapoport <r...@linux.vnet.ibm.com> Cc: Greg Kroah-Hartman <gre...@linuxfoundation.org> Cc: "Aneesh Kumar K.V" <aneesh.ku...@linux.ibm.com> Cc: Thomas Gleixner <t...@linutronix.de> Cc: linuxppc-...@lists.ozlabs.org Cc: linux-kernel@vger.kernel.org --- arch/powerpc/kernel/prom.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c index 7159e79..ad87b94 100644 --- a/arch/powerpc/kernel/prom.c +++ b/arch/powerpc/kernel/prom.c @@ -872,13 +872,15 @@ EXPORT_SYMBOL(of_get_ibm_chip_id); int cpu_to_chip_id(int cpu) { struct device_node *np; + int id; np = of_get_cpu_node(cpu, NULL); if (!np) return -1; + id = of_get_ibm_chip_id(np); of_node_put(np); - return of_get_ibm_chip_id(np); + return id; } EXPORT_SYMBOL(cpu_to_chip_id); -- 2.9.5