From patchwork Sun Feb 28 01:33:19 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Shawn Guo X-Patchwork-Id: 388431 Delivered-To: patch@linaro.org Received: by 2002:a02:290e:0:0:0:0:0 with SMTP id p14csp2321103jap; Sat, 27 Feb 2021 17:34:20 -0800 (PST) X-Google-Smtp-Source: ABdhPJy9wwjVEG9E1Vsp9/UogSLDZXUFRpXxpE1UB5lw8lYsJbKNwBReeY+FrE0oBYwZ/slYZ1Nl X-Received: by 2002:a17:907:da0:: with SMTP id go32mr9932698ejc.203.1614476060287; Sat, 27 Feb 2021 17:34:20 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1614476060; cv=none; d=google.com; s=arc-20160816; b=FmXNrOk537gYkcmyh4SmJaGOrN/OPFpkmGiYY4MdwmL31qGmAVe225jww8lMV57noc n9xoIswob5N5pQcg8e6aW9NdWtdedkLXvrMCMWwjPo9PZUI+/h2G01ZKDJXM3Gu0VdvF DRTG4ABhqSQFoCYoIMFXLm1xHaFTaNJ1waNsP2IUvnp0LkQ6sIIocbgm4FfX6F0B2dGw C8ad3HgGBdd+mNBrrM9NIo+1p9tjOAfzZNWYi6xXTLZhQ9mGo61z0VpJVqnN/bJLNLok wa2dhBxX27E7L9lCj5gvHu8rSgF4KK4Y5Vb4LCvkCJ2fwsYp+g0qjHbC/SJaBbCK/lqZ G+WQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:message-id:date:subject:cc:to:from :dkim-signature; bh=uKgrFKJjppxflukU5myFTP3NdBmrSyJNhIZiE+dOu5o=; b=SxRcgEsSclShwamX+IEPxG1x+aXDUaA0XOoNkhfsVTgLZ3ONQBBBNTyfiJUv38AKrh Spzn/OXWiIqIn+taKcRTqMXyFbPy67kmdtxnlbyulEXLkNAXwZc+ouFj89SZ5Bxril0R fWTix7rtXMeifdVNKnGx0p/b4L+Q+JPSugaZOv6FuiA5YeG6LQHhSivJpGK3kaMcuoGN EZw8MZGkfqJ6aIKO0z8BIejK0UZgzHSDVmzTsYtjdO8CQ9NSmDyr0B93VhHaXGfFaQYH Pvp3H9gOTaeL32glbLFR3wHIQG8yJd+1Ah7GzQuCTj//qQUSN54VDaj/YRja3bmPAWCe Rk0A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=D1tLWT2C; spf=pass (google.com: domain of linux-pm-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-pm-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id p12si8675642ejm.633.2021.02.27.17.34.19; Sat, 27 Feb 2021 17:34:20 -0800 (PST) Received-SPF: pass (google.com: domain of linux-pm-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=D1tLWT2C; spf=pass (google.com: domain of linux-pm-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-pm-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230075AbhB1BeS (ORCPT + 7 others); Sat, 27 Feb 2021 20:34:18 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47622 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229640AbhB1BeS (ORCPT ); Sat, 27 Feb 2021 20:34:18 -0500 Received: from mail-pg1-x52f.google.com (mail-pg1-x52f.google.com [IPv6:2607:f8b0:4864:20::52f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E457CC06174A for ; Sat, 27 Feb 2021 17:33:37 -0800 (PST) Received: by mail-pg1-x52f.google.com with SMTP id x29so460805pgk.6 for ; Sat, 27 Feb 2021 17:33:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id; bh=uKgrFKJjppxflukU5myFTP3NdBmrSyJNhIZiE+dOu5o=; b=D1tLWT2CuzaThw5SeZyJof87G42d8JlGRrSBuFNhJfByh2Bs2Z28m0N12uzorxUHoz nekSuDHlRATAQCW7uNj0sH10TUkF6bEqUwMxD0VZyU1NcQTtwcsj0A/IWN75z6ywLjvl AN4qUo+wR8CNaUkaZoT6x9dULPxjQ5oTvHBV3TmtpJDfTsGVgJkSI2I7Ssc2W7PuTfSH TieDbo2BQwSmFdLK0MPuTXieDT3SDRyYG67V4oqQfM+GycOsEO+yqc5ao3yN01c/6EDd 1qBXr7iN0xqXJBmvxPfrMRFcSoG1kkD4Dcw/X+rpIYxdgh59zgh1YzL0iXwirqbMwADw c3oA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=uKgrFKJjppxflukU5myFTP3NdBmrSyJNhIZiE+dOu5o=; b=O3E68QS0DfUg/cYYhcRqz3C8FUWspDdv7FGwgRjDh9A3pnj8CR3WwOIJel2QKsWYs5 YQzLjU+v56cnuQnyoJqFeYjEyYQObl4NVdkzjN481hAUTfZPsr0h1wtyAjatEbiAuqkq VIqZrIpcJDy4N8nTKC6FMhWh4LEGu6DtXVysxOWv+d/cHZy0bSAnc2cvhzmRYhD1MtX9 fRDypCXdK06nvz3hEbYO4BpXVoir6L4hYc7VwcBwwBKnLMxp9AXT1u5Ek9CqJQOZxXUU 3d31hgF9g6H00j0BCr9RSOKkwPPcG2/279gWOS1/lTB0MC/YNiy19eKD6FidOwE8vZnp WVPA== X-Gm-Message-State: AOAM531JeR9HJ2/4iX34fWI4D72oO8eygPqZG9/phzJXXz2dkfBg/AlJ h0pwxm73BXqjFWY0JigjMd6ddg== X-Received: by 2002:aa7:8bd2:0:b029:1ee:1838:685f with SMTP id s18-20020aa78bd20000b02901ee1838685fmr9524727pfd.64.1614476017538; Sat, 27 Feb 2021 17:33:37 -0800 (PST) Received: from localhost.localdomain (80.251.214.228.16clouds.com. [80.251.214.228]) by smtp.gmail.com with ESMTPSA id x68sm13361827pfc.26.2021.02.27.17.33.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 27 Feb 2021 17:33:37 -0800 (PST) From: Shawn Guo To: Viresh Kumar Cc: linux-pm@vger.kernel.org, linux-kernel@vger.kernel.org, Shawn Guo Subject: [PATCH] cpufreq: qcom-hw: fix dereferencing freed memory 'data' Date: Sun, 28 Feb 2021 09:33:19 +0800 Message-Id: <20210228013319.10469-1-shawn.guo@linaro.org> X-Mailer: git-send-email 2.17.1 Precedence: bulk List-ID: X-Mailing-List: linux-pm@vger.kernel.org Commit 67fc209b527d ("cpufreq: qcom-hw: drop devm_xxx() calls from init/exit hooks") introduces an issue of dereferencing freed memory 'data'. Fix it. Fixes: 67fc209b527d ("cpufreq: qcom-hw: drop devm_xxx() calls from init/exit hooks") Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Shawn Guo --- Viresh, The issue was introduced by v2 of "cpufreq: qcom-hw: drop devm_xxx() calls from init/exit hooks", which misses the conversion of 'data->base' in error path. Sorry! Shawn drivers/cpufreq/qcom-cpufreq-hw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.17.1 diff --git a/drivers/cpufreq/qcom-cpufreq-hw.c b/drivers/cpufreq/qcom-cpufreq-hw.c index d3c23447b892..bee5d67a8227 100644 --- a/drivers/cpufreq/qcom-cpufreq-hw.c +++ b/drivers/cpufreq/qcom-cpufreq-hw.c @@ -374,7 +374,7 @@ static int qcom_cpufreq_hw_cpu_init(struct cpufreq_policy *policy) error: kfree(data); unmap_base: - iounmap(data->base); + iounmap(base); release_region: release_mem_region(res->start, resource_size(res)); return ret;