From: Heikki Krogerus <heikki.kroge...@linux.intel.com>
In device_remove_property_set(), the secondary fwnode needs
to be cleared before the pset is freed. This fixes a
use-after-free when a property set is providing the primary
fwnode.
As a result of the fix, the primary fwnode may end up
containing ERR_PTR(-ENODEV), so also adding checks for it to
the property handling code.
Reported-by: John Youn <john.y...@synopsys.com>
Signed-off-by: Heikki Krogerus <heikki.kroge...@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wyso...@intel.com>
(cherry picked from commit 0d67e0fa1664ad6aaba0552e170608bafb4b6196)
Signed-off-by: Wan Ahmad Zainie <wan.ahmad.zainie.wan.moha...@intel.com>
---
drivers/base/property.c | 25 +++++++++++++++++--------
1 file changed, 17 insertions(+), 8 deletions(-)
diff --git a/drivers/base/property.c b/drivers/base/property.c
index b626ce2..f22a626 100644
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -215,7 +215,8 @@ bool fwnode_property_present(struct fwnode_handle *fwnode,
const char *propname)
bool ret;
ret = __fwnode_property_present(fwnode, propname);
- if (ret == false && fwnode && !IS_ERR_OR_NULL(fwnode->secondary))
+ if (ret == false && !IS_ERR_OR_NULL(fwnode) &&
+ !IS_ERR_OR_NULL(fwnode->secondary))
ret = __fwnode_property_present(fwnode->secondary, propname);
return ret;
}
@@ -420,7 +421,8 @@ EXPORT_SYMBOL_GPL(device_property_match_string);
int _ret_;
\
_ret_ = FWNODE_PROP_READ(_fwnode_, _propname_, _type_, _proptype_,
\
_val_, _nval_);
\
- if (_ret_ == -EINVAL && _fwnode_ &&
!IS_ERR_OR_NULL(_fwnode_->secondary)) \
+ if (_ret_ == -EINVAL && !IS_ERR_OR_NULL(_fwnode_) &&
\
+ !IS_ERR_OR_NULL(_fwnode_->secondary))
\
_ret_ = FWNODE_PROP_READ(_fwnode_->secondary, _propname_,
_type_, \
_proptype_, _val_, _nval_);
\
_ret_;
\
@@ -590,7 +592,8 @@ int fwnode_property_read_string_array(struct fwnode_handle
*fwnode,
int ret;
ret = __fwnode_property_read_string_array(fwnode, propname, val, nval);
- if (ret == -EINVAL && fwnode && !IS_ERR_OR_NULL(fwnode->secondary))
+ if (ret == -EINVAL && !IS_ERR_OR_NULL(fwnode) &&
+ !IS_ERR_OR_NULL(fwnode->secondary))
ret = __fwnode_property_read_string_array(fwnode->secondary,
propname, val, nval);
return ret;
@@ -618,7 +621,8 @@ int fwnode_property_read_string(struct fwnode_handle
*fwnode,
int ret;
ret = __fwnode_property_read_string(fwnode, propname, val);
- if (ret == -EINVAL && fwnode && !IS_ERR_OR_NULL(fwnode->secondary))
+ if (ret == -EINVAL && !IS_ERR_OR_NULL(fwnode) &&
+ !IS_ERR_OR_NULL(fwnode->secondary))
ret = __fwnode_property_read_string(fwnode->secondary,
propname, val);
return ret;
@@ -817,11 +821,16 @@ void device_remove_property_set(struct device *dev)
* the pset. If there is no real firmware node (ACPI/DT) primary
* will hold the pset.
*/
- if (!is_pset_node(fwnode))
- fwnode = fwnode->secondary;
- if (!IS_ERR(fwnode) && is_pset_node(fwnode))
+ if (is_pset_node(fwnode)) {
+ set_primary_fwnode(dev, NULL);
pset_free_set(to_pset_node(fwnode));
- set_secondary_fwnode(dev, NULL);
+ } else {
+ fwnode = fwnode->secondary;
+ if (!IS_ERR(fwnode) && is_pset_node(fwnode)) {
+ set_secondary_fwnode(dev, NULL);
+ pset_free_set(to_pset_node(fwnode));
+ }
+ }
}
EXPORT_SYMBOL_GPL(device_remove_property_set);
--
1.9.1
--
_______________________________________________
linux-yocto mailing list
linux-yocto@yoctoproject.org
https://lists.yoctoproject.org/listinfo/linux-yocto
