From: Sasha Levin <sashal@kernel.org> To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Wen Yang <wen.yang99@zte.com.cn>, Alan Tull <atull@kernel.org>, Moritz Fischer <mdf@kernel.org>, Nicolas Saenz Julienne <nsaenzjulienne@suse.de>, linux-fpga@vger.kernel.org, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Sasha Levin <sashal@kernel.org> Subject: [PATCH AUTOSEL 5.1 14/59] fpga: stratix10-soc: fix use-after-free on s10_init() Date: Fri, 14 Jun 2019 16:27:58 -0400 Message-ID: <20190614202843.26941-14-sashal@kernel.org> (raw) In-Reply-To: <20190614202843.26941-1-sashal@kernel.org> From: Wen Yang <wen.yang99@zte.com.cn> [ Upstream commit f5dd87326fefe42a4b1a4b1a1a695060c33a88d6 ] The refcount of fw_np has already been decreased by of_find_matching_node() so it shouldn't be used anymore. This patch adds an of_node_get() before of_find_matching_node() to avoid the use-after-free problem. Fixes: e7eef1d7633a ("fpga: add intel stratix10 soc fpga manager driver") Signed-off-by: Wen Yang <wen.yang99@zte.com.cn> Cc: Alan Tull <atull@kernel.org> Cc: Moritz Fischer <mdf@kernel.org> Cc: Nicolas Saenz Julienne <nsaenzjulienne@suse.de> Cc: linux-fpga@vger.kernel.org Cc: linux-kernel@vger.kernel.org Reviewed-by: Moritz Fischer <mdf@kernel.org> Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de> Acked-by: Alan Tull <atull@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org> --- drivers/fpga/stratix10-soc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/fpga/stratix10-soc.c b/drivers/fpga/stratix10-soc.c index 13851b3d1c56..215d33789c74 100644 --- a/drivers/fpga/stratix10-soc.c +++ b/drivers/fpga/stratix10-soc.c @@ -507,12 +507,16 @@ static int __init s10_init(void) if (!fw_np) return -ENODEV; + of_node_get(fw_np); np = of_find_matching_node(fw_np, s10_of_match); - if (!np) + if (!np) { + of_node_put(fw_np); return -ENODEV; + } of_node_put(np); ret = of_platform_populate(fw_np, s10_of_match, NULL, NULL); + of_node_put(fw_np); if (ret) return ret; -- 2.20.1
next prev parent reply index Thread overview: 45+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-06-14 20:27 [PATCH AUTOSEL 5.1 01/59] lkdtm/usercopy: Moves the KERNEL_DS test to non-canonical Sasha Levin 2019-06-14 20:27 ` [PATCH AUTOSEL 5.1 02/59] ARC: fix build warnings Sasha Levin 2019-06-14 20:27 ` [PATCH AUTOSEL 5.1 03/59] dmaengine: jz4780: Fix transfers being ACKed too soon Sasha Levin 2019-06-14 20:27 ` [PATCH AUTOSEL 5.1 04/59] dmaengine: dw-axi-dmac: fix null dereference when pointer first is null Sasha Levin 2019-06-14 20:27 ` [PATCH AUTOSEL 5.1 05/59] dmaengine: mediatek-cqdma: sleeping in atomic context Sasha Levin 2019-06-14 20:27 ` [PATCH AUTOSEL 5.1 06/59] dmaengine: sprd: Fix the possible crash when getting descriptor status Sasha Levin 2019-06-14 20:27 ` [PATCH AUTOSEL 5.1 07/59] dmaengine: sprd: Add validation of current descriptor in irq handler Sasha Levin 2019-06-14 20:27 ` [PATCH AUTOSEL 5.1 08/59] dmaengine: sprd: Fix the incorrect start for 2-stage destination channels Sasha Levin 2019-06-14 20:27 ` [PATCH AUTOSEL 5.1 09/59] dmaengine: sprd: Fix block length overflow Sasha Levin 2019-06-14 20:27 ` [PATCH AUTOSEL 5.1 10/59] dmaengine: sprd: Fix the right place to configure 2-stage transfer Sasha Levin 2019-06-14 20:27 ` [PATCH AUTOSEL 5.1 11/59] ARC: [plat-hsdk]: Add missing multicast filter bins number to GMAC node Sasha Levin 2019-06-14 20:27 ` [PATCH AUTOSEL 5.1 12/59] ARC: [plat-hsdk]: Add missing FIFO size entry in " Sasha Levin 2019-06-14 20:27 ` [PATCH AUTOSEL 5.1 13/59] MIPS: mark ginvt() as __always_inline Sasha Levin 2019-06-14 20:27 ` Sasha Levin [this message] 2019-06-14 20:27 ` [PATCH AUTOSEL 5.1 15/59] fpga: dfl: afu: Pass the correct device to dma_mapping_error() Sasha Levin 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 16/59] fpga: dfl: Add lockdep classes for pdata->lock Sasha Levin 2019-06-15 5:47 ` Greg Kroah-Hartman 2019-06-15 22:41 ` Sasha Levin 2019-06-16 7:09 ` Greg Kroah-Hartman 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 17/59] fpga: dfl: expand minor range when registering chrdev region Sasha Levin 2019-06-15 5:48 ` Greg Kroah-Hartman 2019-06-23 19:26 ` Sasha Levin 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 18/59] parport: Fix mem leak in parport_register_dev_model Sasha Levin 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 19/59] parisc: Fix compiler warnings in float emulation code Sasha Levin 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 20/59] habanalabs: fix bug in checking huge page optimization Sasha Levin 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 21/59] IB/rdmavt: Fix alloc_qpn() WARN_ON() Sasha Levin 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 22/59] IB/hfi1: Insure freeze_work work_struct is canceled on shutdown Sasha Levin 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 23/59] IB/{qib, hfi1, rdmavt}: Correct ibv_devinfo max_mr value Sasha Levin 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 24/59] IB/hfi1: Validate page aligned for a given virtual address Sasha Levin 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 25/59] MIPS: uprobes: remove set but not used variable 'epc' Sasha Levin 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 26/59] crypto: hmac - fix memory leak in hmac_init_tfm() Sasha Levin 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 27/59] xtensa: Fix section mismatch between memblock_reserve and mem_reserve Sasha Levin 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 28/59] kselftest/cgroup: fix unexpected testing failure on test_memcontrol Sasha Levin 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 29/59] kselftest/cgroup: fix unexpected testing failure on test_core Sasha Levin 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 30/59] kselftest/cgroup: fix incorrect test_core skip Sasha Levin 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 31/59] userfaultfd: selftest: fix compiler warning Sasha Levin 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 32/59] selftests: vm: install test_vmalloc.sh for run_vmtests Sasha Levin 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 33/59] nds32: Avoid IEX status being incorrectly modified Sasha Levin 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 34/59] net: dsa: mv88e6xxx: avoid error message on remove from VLAN 0 Sasha Levin 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 35/59] net: hns: Fix loopback test failed at copper ports Sasha Levin 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 36/59] mdesc: fix a missing-check bug in get_vdev_port_node_info() Sasha Levin 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 37/59] sparc: perf: fix updated event period in response to PERF_EVENT_IOC_PERIOD Sasha Levin 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 38/59] net: ethernet: mediatek: Use hw_feature to judge if HWLRO is supported Sasha Levin 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 39/59] net: ethernet: mediatek: Use NET_IP_ALIGN to judge if HW RX_2BYTE_OFFSET is enabled Sasha Levin 2019-06-14 20:28 ` [PATCH AUTOSEL 5.1 40/59] selftests: set sysctl bc_forwarding properly in router_broadcast.sh Sasha Levin
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190614202843.26941-14-sashal@kernel.org \ --to=sashal@kernel.org \ --cc=atull@kernel.org \ --cc=gregkh@linuxfoundation.org \ --cc=linux-fpga@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=mdf@kernel.org \ --cc=nsaenzjulienne@suse.de \ --cc=stable@vger.kernel.org \ --cc=wen.yang99@zte.com.cn \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
Stable Archive on lore.kernel.org Archives are clonable: git clone --mirror https://lore.kernel.org/stable/0 stable/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 stable stable/ https://lore.kernel.org/stable \ stable@vger.kernel.org public-inbox-index stable Example config snippet for mirrors Newsgroup available over NNTP: nntp://nntp.lore.kernel.org/org.kernel.vger.stable AGPL code for this site: git clone https://public-inbox.org/public-inbox.git