linux-kernel - Re: [PATCH] cpufreq: scmi: fix use-after-free in scmi_cpufreq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2386834.BKf6y2r8fF@aspire.rjw.lan>
Date:   Tue, 19 Feb 2019 11:18:39 +0100
From:   "Rafael J. Wysocki" <rjw@...ysocki.net>
To:     Viresh Kumar <viresh.kumar@...aro.org>
Cc:     Yangtao Li <tiny.windzz@...il.com>, sudeep.holla@....com,
        linux-arm-kernel@...ts.infradead.org, linux-pm@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] cpufreq: scmi: fix use-after-free in scmi_cpufreq_exit()

On Monday, February 18, 2019 5:53:30 AM CET Viresh Kumar wrote:
> On 16-02-19, 11:31, Yangtao Li wrote:
> > This issue was detected with the help of Coccinelle. So
> > change the order of function calls to fix it.
> > 
> > Fixes: 1690d8bb91e37 (cpufreq: scpi/scmi: Fix freeing of dynamic OPPs)
> > 
> > Signed-off-by: Yangtao Li <tiny.windzz@...il.com>
> > ---
> >  drivers/cpufreq/scmi-cpufreq.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
> > index 242c3370544e..9ed46d188cb5 100644
> > --- a/drivers/cpufreq/scmi-cpufreq.c
> > +++ b/drivers/cpufreq/scmi-cpufreq.c
> > @@ -187,8 +187,8 @@ static int scmi_cpufreq_exit(struct cpufreq_policy *policy)
> >  
> >  	cpufreq_cooling_unregister(priv->cdev);
> >  	dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table);
> > -	kfree(priv);
> >  	dev_pm_opp_remove_all_dynamic(priv->cpu_dev);
> > +	kfree(priv);
> >  
> >  	return 0;
> >  }
> 
> Acked-by: Viresh Kumar <viresh.kumar@...aro.org>
> 
> @Rafael: Please pick it up for 5.0-rc8 as the bug was introduced
> during 5.0 cycle only.
> 
> The patch it fixes had this tag:
> 
>     Cc: 4.20 <stable@...r.kernel.org> # v4.20
> 
> And so will get applied to 4.20.N, I guess we need to mark this patch
> as well for stable then.

Done now, thanks!