From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DCFC1C3A5A8 for ; Wed, 4 Sep 2019 18:14:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B7C8823400 for ; Wed, 4 Sep 2019 18:14:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1567620840; bh=yYpBrXSse8jC7Y/RgIAkCtAYzAY7Kh8rMxaOmj2tflY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=WjLtPS5B3h6in9Rav/kQOsQHuYBv+Cw5YYt0ky4u3TFNTBLJb847/DTgHh3cT5Y4b tXVTwMd9vXlGVzMNRzF/X9arOS2h7Lni2Ro1NKRszrzsdWa70YFuoBZvSsX9fYulKe IF728Eg3hL18H2+a046jbsrRg3VlXp4gOBSmz7FM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2390405AbfIDSN7 (ORCPT ); Wed, 4 Sep 2019 14:13:59 -0400 Received: from mail.kernel.org ([198.145.29.99]:58934 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2390143AbfIDSN7 (ORCPT ); Wed, 4 Sep 2019 14:13:59 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 022A2206BA; Wed, 4 Sep 2019 18:13:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1567620838; bh=yYpBrXSse8jC7Y/RgIAkCtAYzAY7Kh8rMxaOmj2tflY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CfBl6UNS5dY0DSVUMxAX4vpYAGA/5Af+9ogpxSly5JicV/YgqqZjbkacNOq+lv79b 08/Jjjv/WOtgQJtJQsjM+picOBeuvMuohkhsFjzD7HcbdxJOZXC9QBUihUfl8vbvDf 2pXcuCyAeYgVDePmmfDys1T2DwtS7oB0KUE5zCsc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, John Garry , Wei Xu Subject: [PATCH 5.2 115/143] bus: hisi_lpc: Unregister logical PIO range to avoid potential use-after-free Date: Wed, 4 Sep 2019 19:54:18 +0200 Message-Id: <20190904175318.893845918@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20190904175314.206239922@linuxfoundation.org> References: <20190904175314.206239922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: John Garry commit 1b15a5632a809ab57d403fd972ca68785363b654 upstream. If, after registering a logical PIO range, the driver probe later fails, the logical PIO range memory will be released automatically. This causes an issue, in that the logical PIO range is not unregistered and the released range memory may be later referenced. Fix by unregistering the logical PIO range. And since we now unregister the logical PIO range for probe failure, avoid the special ordering of setting logical PIO range ops, which was the previous (poor) attempt at a safeguard against this. Cc: stable@vger.kernel.org Fixes: adf38bb0b595 ("HISI LPC: Support the LPC host on Hip06/Hip07 with DT bindings") Signed-off-by: John Garry Signed-off-by: Wei Xu Signed-off-by: Greg Kroah-Hartman --- drivers/bus/hisi_lpc.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) --- a/drivers/bus/hisi_lpc.c +++ b/drivers/bus/hisi_lpc.c @@ -606,24 +606,25 @@ static int hisi_lpc_probe(struct platfor range->fwnode = dev->fwnode; range->flags = LOGIC_PIO_INDIRECT; range->size = PIO_INDIRECT_SIZE; + range->hostdata = lpcdev; + range->ops = &hisi_lpc_ops; + lpcdev->io_host = range; ret = logic_pio_register_range(range); if (ret) { dev_err(dev, "register IO range failed (%d)!\n", ret); return ret; } - lpcdev->io_host = range; /* register the LPC host PIO resources */ if (acpi_device) ret = hisi_lpc_acpi_probe(dev); else ret = of_platform_populate(dev->of_node, NULL, NULL, dev); - if (ret) + if (ret) { + logic_pio_unregister_range(range); return ret; - - lpcdev->io_host->hostdata = lpcdev; - lpcdev->io_host->ops = &hisi_lpc_ops; + } io_end = lpcdev->io_host->io_start + lpcdev->io_host->size; dev_info(dev, "registered range [%pa - %pa]\n",