From patchwork Wed Sep 4 17:54:18 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 172947 Delivered-To: patch@linaro.org Received: by 2002:ac9:5c4b:0:0:0:0:0 with SMTP id r11csp1045096ocp; Wed, 4 Sep 2019 11:08:13 -0700 (PDT) X-Google-Smtp-Source: APXvYqyvJMOoQJ7cCiyMJJ8GBpozGEFozftlprbdZtYnnmqEdBuOduF97BSNBLi0N5QhqZ+Sgfog X-Received: by 2002:aa7:9e04:: with SMTP id y4mr47117100pfq.18.1567620493544; Wed, 04 Sep 2019 11:08:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1567620493; cv=none; d=google.com; s=arc-20160816; b=Ia+aAIcv8l6SF4ePMLKmOEt03bqNH8HCwyIcdPn1tJQHXV9nn8yhKjZLI2MxN2o/dx ER4RnrNuxeSfPPb1bQCf3Sd6e0DETSZ6DPGjUllLYWrve+6ncHt42DHfmq8bWrYOBTGM gsiBRS9pPxilv8EPB5sy+rrqY1tXi5sH1JcOjsc97a+1hHQdQmcpBbF97AmF1OoMuE9x n/8rFWLI4NKr2GejP/cMfCUjnZIwOcueIo61rLOTCEMU9Mpe0dGNeDSri5PSBEwIjvhB 22oSgrRAAy0R2Qt13k9FOfGcsQMCfZpDmwmt9l+LEDiq8NZ/m9ctsMtGwmKHzS4ewkbH OBag== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=CKu4w6/0CNsugLOOOLmzEux0cAf0NqIkTu290+0pKac=; b=YJE0vQdWKmcnj38bTf9eDnK74qsX6eiNEs5gwqPMCm8aTP7OBHTnQOc3ywf/V+Akdd ncA48rUlZXQSXTNZUX3DrmU01NDYrlCzzS9+W4SZFyLyH0O179bwkV9GOSShniCV1vZs M/9Y810alUe4baQcwbUdYQruNXr4WZAU4vlXSOiNANSKuH4TeGjNRRqapc3xQ3Uuqvq6 +UX8UhdI4c0/p2Zm9UL6dMnKurBytOm1m1tpLlv27lnTawjONrBF9iBU0GjKNIyMfgMS rwcX9i1IDewMNCOE3Zpei3HmAzU0T4Vp+PdyMpR6ov8nkQ6F+hmiknNKwqYnQw3DLqO2 Fv8w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=Q1ru0Ivw; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id u65si14818025pfu.160.2019.09.04.11.08.13; Wed, 04 Sep 2019 11:08:13 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=Q1ru0Ivw; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389737AbfIDSIM (ORCPT + 28 others); Wed, 4 Sep 2019 14:08:12 -0400 Received: from mail.kernel.org ([198.145.29.99]:50856 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388808AbfIDSIJ (ORCPT ); Wed, 4 Sep 2019 14:08:09 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3A5F320870; Wed, 4 Sep 2019 18:08:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1567620488; bh=A6jqfQt1fU2Vf6DkHcpoLkmMml53rNnwKzLsF4280cs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Q1ru0Ivwjb31MqRzaO5nRNgD3x5U1NqwJ3f8oOgePsBv6c32YukftHAoMczdqnVap CpjLNg+FEhRbDiT88xIh4qs1xOEVVU5f/GGcbU+lt2NX1EMcxstFDZJzCueQRl2nM0 GlSs1HzK8A/3VQfMQeqGmxVO/vwGPH68AmJhRKxc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, John Garry , Wei Xu Subject: [PATCH 4.19 76/93] bus: hisi_lpc: Unregister logical PIO range to avoid potential use-after-free Date: Wed, 4 Sep 2019 19:54:18 +0200 Message-Id: <20190904175309.655425948@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20190904175302.845828956@linuxfoundation.org> References: <20190904175302.845828956@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: John Garry commit 1b15a5632a809ab57d403fd972ca68785363b654 upstream. If, after registering a logical PIO range, the driver probe later fails, the logical PIO range memory will be released automatically. This causes an issue, in that the logical PIO range is not unregistered and the released range memory may be later referenced. Fix by unregistering the logical PIO range. And since we now unregister the logical PIO range for probe failure, avoid the special ordering of setting logical PIO range ops, which was the previous (poor) attempt at a safeguard against this. Cc: stable@vger.kernel.org Fixes: adf38bb0b595 ("HISI LPC: Support the LPC host on Hip06/Hip07 with DT bindings") Signed-off-by: John Garry Signed-off-by: Wei Xu Signed-off-by: Greg Kroah-Hartman --- drivers/bus/hisi_lpc.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) --- a/drivers/bus/hisi_lpc.c +++ b/drivers/bus/hisi_lpc.c @@ -607,24 +607,25 @@ static int hisi_lpc_probe(struct platfor range->fwnode = dev->fwnode; range->flags = LOGIC_PIO_INDIRECT; range->size = PIO_INDIRECT_SIZE; + range->hostdata = lpcdev; + range->ops = &hisi_lpc_ops; + lpcdev->io_host = range; ret = logic_pio_register_range(range); if (ret) { dev_err(dev, "register IO range failed (%d)!\n", ret); return ret; } - lpcdev->io_host = range; /* register the LPC host PIO resources */ if (acpi_device) ret = hisi_lpc_acpi_probe(dev); else ret = of_platform_populate(dev->of_node, NULL, NULL, dev); - if (ret) + if (ret) { + logic_pio_unregister_range(range); return ret; - - lpcdev->io_host->hostdata = lpcdev; - lpcdev->io_host->ops = &hisi_lpc_ops; + } io_end = lpcdev->io_host->io_start + lpcdev->io_host->size; dev_info(dev, "registered range [%pa - %pa]\n",