Merge tag 'scmi-fixes-4.17' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into fixes

olofj · olofj · commit 16145fff3750 · 2018-05-14T01:05:00.000-07:00
SCMI fix for v4.17

A single patch to ensure that the scmi device is not used for setting up
scmi handle after it's freed(fixes use after free).

* tag 'scmi-fixes-4.17' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux:
  firmware: arm_scmi: Use after free in scmi_create_protocol_device()

Signed-off-by: Olof Johansson &lt;olof@lixom.net&gt;
diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
@@ -778,6 +778,7 @@ scmi_create_protocol_device(struct device_node *np, struct scmi_info *info,
 	if (scmi_mbox_chan_setup(info, &sdev->dev, prot_id)) {
 		dev_err(&sdev->dev, "failed to setup transport\n");
 		scmi_device_destroy(sdev);
+		return;
 	}
 
 	/* setup handle now as the transport is ready */

Original file line number	Diff line number	Diff line change
`@@ -778,6 +778,7 @@ scmi_create_protocol_device(struct device_node np, struct scmi_info info,`
`778`	`778`	`if (scmi_mbox_chan_setup(info, &sdev->dev, prot_id)) {`
`779`	`779`	`dev_err(&sdev->dev, "failed to setup transport\n");`
`780`	`780`	`scmi_device_destroy(sdev);`
	`781`	`+ return;`
`781`	`782`	`}`
`782`	`783`
`783`	`784`	`/* setup handle now as the transport is ready */`