From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757765AbbLBW4x (ORCPT ); Wed, 2 Dec 2015 17:56:53 -0500 Received: from youngberry.canonical.com ([91.189.89.112]:48124 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758640AbbLBWzo (ORCPT ); Wed, 2 Dec 2015 17:55:44 -0500 From: Kamal Mostafa To: linux-kernel@vger.kernel.org, stable@vger.kernel.org, kernel-team@lists.ubuntu.com Cc: Christophe JAILLET , Jarkko Sakkinen , Luis Henriques , Kamal Mostafa Subject: [PATCH 3.13.y-ckt 86/86] TPM: Avoid reference to potentially freed memory Date: Wed, 2 Dec 2015 14:54:47 -0800 Message-Id: <1449096887-23017-87-git-send-email-kamal@canonical.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1449096887-23017-1-git-send-email-kamal@canonical.com> References: <1449096887-23017-1-git-send-email-kamal@canonical.com> X-Extended-Stable: 3.13 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.13.11-ckt31 -stable review patch. If anyone has any objections, please let me know. ------------------ From: Christophe JAILLET commit eb8ed1eb9a158c460d10205eaff71fd4ac67c160 upstream. Reference to the 'np' node is dropped before dereferencing the 'sizep' and 'basep' pointers, which could by then point to junk if the node has been freed. Refactor code to call 'of_node_put' later. Fixes: c5df39262dd5 ("drivers/char/tpm: Add securityfs support for event log") Signed-off-by: Christophe JAILLET Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen Acked-by: Peter Huewe [ luis: backported to 3.16: adjusted context ] Signed-off-by: Luis Henriques Signed-off-by: Kamal Mostafa --- drivers/char/tpm/tpm_of.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/char/tpm/tpm_of.c b/drivers/char/tpm/tpm_of.c index 98ba2bd..565a0b3 100644 --- a/drivers/char/tpm/tpm_of.c +++ b/drivers/char/tpm/tpm_of.c @@ -53,17 +53,18 @@ int read_log(struct tpm_bios_log *log) goto cleanup_eio; } - of_node_put(np); log->bios_event_log = kmalloc(*sizep, GFP_KERNEL); if (!log->bios_event_log) { pr_err("%s: ERROR - Not enough memory for BIOS measurements\n", __func__); + of_node_put(np); return -ENOMEM; } log->bios_event_log_end = log->bios_event_log + *sizep; memcpy(log->bios_event_log, __va(be64_to_cpup(basep)), *sizep); + of_node_put(np); return 0; -- 1.9.1