linux-kernel - Re: [PATCH] drivers/thermal/tegra: fix a doule free devce node

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d2987e9f-5cbf-9622-c6b9-b8bc66b3a5a2@linaro.org>
Date:   Tue, 14 Aug 2018 08:39:24 +0200
From:   Daniel Lezcano <daniel.lezcano@...aro.org>
To:     zhong jiang <zhongjiang@...wei.com>, ezequiel@...labora.com
Cc:     rui.zhang@...el.com, edubezval@...il.com, jonathanh@...dia.com,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] drivers/thermal/tegra: fix a doule free devce node

On 09/08/2018 15:40, zhong jiang wrote:
> Device node iterators will get the return node. Meawhile, It is
> also put the previous device node. An explicit put will cause
> a double put.

What about:

Subject: drivers/thermal/tegra: Fix a double free on the device node

"The function 'for_each_child_of_node' iterates over the node list by
dropping the of_node reference of the previous node.

Calling of_node_put() on the iterator is pointless and leads to an
inconsistent refcounting in addition to a double free. Remove it."

> Signed-off-by: zhong jiang <zhongjiang@...wei.com>
> ---
>  drivers/thermal/tegra/soctherm.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/drivers/thermal/tegra/soctherm.c b/drivers/thermal/tegra/soctherm.c
> index ed28110..3aa55c9 100644
> --- a/drivers/thermal/tegra/soctherm.c
> +++ b/drivers/thermal/tegra/soctherm.c
> @@ -980,7 +980,6 @@ static void soctherm_init_hw_throt_cdev(struct platform_device *pdev)
>  		tcd = thermal_of_cooling_device_register(np_stcc,
>  							 (char *)name, ts,
>  							 &throt_cooling_ops);
> -		of_node_put(np_stcc);
>  		if (IS_ERR_OR_NULL(tcd)) {
>  			dev_err(dev,
>  				"throttle-cfg: %s: failed to register cooling device\n",
> 


-- 
 <http://www.linaro.org/> Linaro.org │ Open source software for ARM SoCs

Follow Linaro:  <http://www.facebook.com/pages/Linaro> Facebook |
<http://twitter.com/#!/linaroorg> Twitter |
<http://www.linaro.org/linaro-blog/> Blog