From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755178AbaEDQvA (ORCPT ); Sun, 4 May 2014 12:51:00 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:35993 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753846AbaEDPl1 (ORCPT ); Sun, 4 May 2014 11:41:27 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Krzysztof Kozlowski , Lee Jones Subject: [PATCH 3.14 048/158] mfd: tps65910: Fix possible invalid pointer dereference on regmap_add_irq_chip fail Date: Sun, 4 May 2014 11:39:17 -0400 Message-Id: <20140504154036.520950454@linuxfoundation.org> X-Mailer: git-send-email 1.9.0 In-Reply-To: <20140504154029.975081050@linuxfoundation.org> References: <20140504154029.975081050@linuxfoundation.org> User-Agent: quilt/0.60-1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Krzysztof Kozlowski commit 483e2dfdbc94751430e41db9973985f5b054d322 upstream. Fixes: 4aab3fadad32 ("mfd: tps65910: Move interrupt implementation code to mfd file") tps65910_irq_init() sets 'tps65910->chip_irq' before calling regmap_add_irq_chip(). If the regmap_add_irq_chip() call fails in memory allocation of regmap_irq_chip_data members then: 1. The 'tps65910->chip_irq' will still hold some value 2. 'tps65910->irq_data' will be pointing to already freed memory (because regmap_add_irq_chip() will free it on error) This results in invalid memory access during driver remove because the tps65910_irq_exit() tests whether 'tps65910->chip_irq' is not zero. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Signed-off-by: Greg Kroah-Hartman --- drivers/mfd/tps65910.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/mfd/tps65910.c +++ b/drivers/mfd/tps65910.c @@ -255,8 +255,10 @@ static int tps65910_irq_init(struct tps6 ret = regmap_add_irq_chip(tps65910->regmap, tps65910->chip_irq, IRQF_ONESHOT, pdata->irq_base, tps6591x_irqs_chip, &tps65910->irq_data); - if (ret < 0) + if (ret < 0) { dev_warn(tps65910->dev, "Failed to add irq_chip %d\n", ret); + tps65910->chip_irq = 0; + } return ret; }