linux-kernel - [PATCH] arm: mach-versatile: Fix refcount leak bug in tc2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 17 Jun 2022 20:30:03 +0800
From:   Liang He <windhl@....com>
To:     linus.walleij@...aro.org, linux@...linux.org.uk
Cc:     windhl@....com, linux-arm-kernel@...ts.infradead.org,
        linux-kernel@...r.kernel.org
Subject: [PATCH] arm: mach-versatile: Fix refcount leak bug in tc2_pm

In tc2_pm_init(), of_find_compatible_node() will return a node pointer
with refcount incremented. We should use of_node_put() in fail path or
when it is not used anymore.

Signed-off-by: Liang He <windhl@....com>
---
 arch/arm/mach-versatile/tc2_pm.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-versatile/tc2_pm.c b/arch/arm/mach-versatile/tc2_pm.c
index 0fe78da0c109..2a7aeab7b3da 100644
--- a/arch/arm/mach-versatile/tc2_pm.c
+++ b/arch/arm/mach-versatile/tc2_pm.c
@@ -212,19 +212,24 @@ static int __init tc2_pm_init(void)
 	np = of_find_compatible_node(NULL, NULL,
 			"arm,vexpress-scc,v2p-ca15_a7");
 	scc = of_iomap(np, 0);
-	if (!scc)
+	if (!scc) {
+		of_node_put(np);
 		return -ENODEV;
+	}
 
 	a15_cluster_id = readl_relaxed(scc + A15_CONF) & 0xf;
 	a7_cluster_id = readl_relaxed(scc + A7_CONF) & 0xf;
-	if (a15_cluster_id >= TC2_CLUSTERS || a7_cluster_id >= TC2_CLUSTERS)
+	if (a15_cluster_id >= TC2_CLUSTERS || a7_cluster_id >= TC2_CLUSTERS) {
+		of_node_put(np);
 		return -EINVAL;
+	}
 
 	sys_info = readl_relaxed(scc + SYS_INFO);
 	tc2_nr_cpus[a15_cluster_id] = (sys_info >> 16) & 0xf;
 	tc2_nr_cpus[a7_cluster_id] = (sys_info >> 20) & 0xf;
 
 	irq = irq_of_parse_and_map(np, 0);
+	of_node_put(np);
 
 	/*
 	 * A subset of the SCC registers is also used to communicate
-- 
2.25.1