From patchwork Wed Sep 4 17:54:18 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 172956 Delivered-To: patch@linaro.org Received: by 2002:a05:6e02:ce:0:0:0:0 with SMTP id r14csp272452ilq; Wed, 4 Sep 2019 11:14:00 -0700 (PDT) X-Google-Smtp-Source: APXvYqwKqna9IyBQnxLJeWuTVeiJ1FyOYuqmL8ShuWo19bk9Cah3/plCoHMlXyUWZ9Q2nKjM94Id X-Received: by 2002:a62:82cb:: with SMTP id w194mr45940510pfd.181.1567620840866; Wed, 04 Sep 2019 11:14:00 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1567620840; cv=none; d=google.com; s=arc-20160816; b=VMB5zxeR+U/LXa74K45Gqc/OXnwhUE0sEGpE5czH79Sy6aTP9+qpwFKl9aF8G+HqXP nM/wqFIic6yuvbE9RPshDO9Y78d2GO/KiD1J4/7BiiA/YaksffHqWXHI03gsXHm/LEk1 lE9bE+E4ZfDWA8C/upKGj70/3dSidvaPwjXlDb1dspnpW5yyyBABJjsDm//pEC9Q9Aq3 5ZEnbZk2kdQovwYSJUYmht5XKoRzRRmA5YaWYVnGxPJGjEkiBJt4fB0L0XlJaSNL0pcR JQIjvon7cVqrJe5VbyHk7WxcXYHDG/JSW+onS9zIB5g0jLrJ8y1IBIjAfjQO2KSHMt+Z aRpg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=rnfcI4bz6dtjrnYErzBEIJn72fBVFlRDeJo7UYNvDmM=; b=UhQPs8mcTS3eGSvNRv4nLuWMin4SBciOqi75zQr5orNhp/hMh3D4e/IgoKoJo+BG8D bAHMLoK1n9X09nT35c7lfX2icXhZ+EEu8jq5L9s8crrBhNaIF8AKMOmGy5qq1PP5LyR8 QqxzJZCp6SOYioNA7InQLcMeGKgIgfhtT/attx1ssH5HuZ2feGIIC7UzKjiTKcjpATx4 u+wyoBrOurdsSngVM/yTTG+UT8HI+46x4FLesWfxr7TGeorgv++6VLSSq2bza0236rNF EXKcC6R9QkWLk4n4CE4MNd6au/YWTq9J67TzBOVg1pJrpuchUh6AJBRK2q+BLizEFkb3 8Aug== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=CfBl6UNS; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id k21si20786869pfk.266.2019.09.04.11.14.00; Wed, 04 Sep 2019 11:14:00 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=CfBl6UNS; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2390405AbfIDSN7 (ORCPT + 14 others); Wed, 4 Sep 2019 14:13:59 -0400 Received: from mail.kernel.org ([198.145.29.99]:58934 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2390143AbfIDSN7 (ORCPT ); Wed, 4 Sep 2019 14:13:59 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 022A2206BA; Wed, 4 Sep 2019 18:13:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1567620838; bh=yYpBrXSse8jC7Y/RgIAkCtAYzAY7Kh8rMxaOmj2tflY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CfBl6UNS5dY0DSVUMxAX4vpYAGA/5Af+9ogpxSly5JicV/YgqqZjbkacNOq+lv79b 08/Jjjv/WOtgQJtJQsjM+picOBeuvMuohkhsFjzD7HcbdxJOZXC9QBUihUfl8vbvDf 2pXcuCyAeYgVDePmmfDys1T2DwtS7oB0KUE5zCsc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, John Garry , Wei Xu Subject: [PATCH 5.2 115/143] bus: hisi_lpc: Unregister logical PIO range to avoid potential use-after-free Date: Wed, 4 Sep 2019 19:54:18 +0200 Message-Id: <20190904175318.893845918@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20190904175314.206239922@linuxfoundation.org> References: <20190904175314.206239922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: John Garry commit 1b15a5632a809ab57d403fd972ca68785363b654 upstream. If, after registering a logical PIO range, the driver probe later fails, the logical PIO range memory will be released automatically. This causes an issue, in that the logical PIO range is not unregistered and the released range memory may be later referenced. Fix by unregistering the logical PIO range. And since we now unregister the logical PIO range for probe failure, avoid the special ordering of setting logical PIO range ops, which was the previous (poor) attempt at a safeguard against this. Cc: stable@vger.kernel.org Fixes: adf38bb0b595 ("HISI LPC: Support the LPC host on Hip06/Hip07 with DT bindings") Signed-off-by: John Garry Signed-off-by: Wei Xu Signed-off-by: Greg Kroah-Hartman --- drivers/bus/hisi_lpc.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) --- a/drivers/bus/hisi_lpc.c +++ b/drivers/bus/hisi_lpc.c @@ -606,24 +606,25 @@ static int hisi_lpc_probe(struct platfor range->fwnode = dev->fwnode; range->flags = LOGIC_PIO_INDIRECT; range->size = PIO_INDIRECT_SIZE; + range->hostdata = lpcdev; + range->ops = &hisi_lpc_ops; + lpcdev->io_host = range; ret = logic_pio_register_range(range); if (ret) { dev_err(dev, "register IO range failed (%d)!\n", ret); return ret; } - lpcdev->io_host = range; /* register the LPC host PIO resources */ if (acpi_device) ret = hisi_lpc_acpi_probe(dev); else ret = of_platform_populate(dev->of_node, NULL, NULL, dev); - if (ret) + if (ret) { + logic_pio_unregister_range(range); return ret; - - lpcdev->io_host->hostdata = lpcdev; - lpcdev->io_host->ops = &hisi_lpc_ops; + } io_end = lpcdev->io_host->io_start + lpcdev->io_host->size; dev_info(dev, "registered range [%pa - %pa]\n",