leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

can: flexcan: fix an use-after-free in flexcan_setup_stop_mode()

Browse Source 
The gpr_np variable is still being used in dev_dbg() after the
of_node_put() call, which may result in use-after-free.

Fixes: de3578c198 ("can: flexcan: add self wakeup support")
Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
Cc: linux-stable <stable@vger.kernel.org> # >= v5.0
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
This commit is contained in:
Wen Yang 2019-07-06 11:37:20 +08:00 committed by Marc Kleine-Budde
parent 375f755899
commit e9f2a856e1
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/net/can/flexcan.c
View File

@ -1437,10 +1437,10 @@ static int flexcan_setup_stop_mode(struct platform_device *pdev)
priv = netdev_priv(dev); priv = netdev_priv(dev);
priv->stm.gpr = syscon_node_to_regmap(gpr_np); priv->stm.gpr = syscon_node_to_regmap(gpr_np);
of_node_put(gpr_np);
if (IS_ERR(priv->stm.gpr)) { if (IS_ERR(priv->stm.gpr)) {
dev_dbg(&pdev->dev, "could not find gpr regmap\n"); dev_dbg(&pdev->dev, "could not find gpr regmap\n");
return PTR_ERR(priv->stm.gpr); ret = PTR_ERR(priv->stm.gpr);
goto out_put_node;
} }
priv->stm.req_gpr = out_val[1]; priv->stm.req_gpr = out_val[1];
@ -1455,7 +1455,9 @@ static int flexcan_setup_stop_mode(struct platform_device *pdev)
device_set_wakeup_capable(&pdev->dev, true); device_set_wakeup_capable(&pdev->dev, true);
return 0; out_put_node:
of_node_put(gpr_np);
return ret;
} }
static const struct of_device_id flexcan_of_match[] = { static const struct of_device_id flexcan_of_match[] = {