lkml.org 
[lkml]   [2021]   [May]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 111/530] firmware: xilinx: Fix dereferencing freed memory
    Date
    From: Tejas Patel <tejas.patel@xilinx.com>

    [ Upstream commit f1f21bece82c76a56a96988ec7d51ccc033d8949 ]

    Fix smatch warning:
    drivers/firmware/xilinx/zynqmp.c:1288 zynqmp_firmware_remove()
    error: dereferencing freed memory 'feature_data'

    Use hash_for_each_safe for safe removal of hash entry.

    Fixes: acfdd18591ea ("firmware: xilinx: Use hash-table for api feature check")
    Reported-by: kernel test robot <lkp@intel.com>
    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Tejas Patel <tejas.patel@xilinx.com>
    Signed-off-by: Rajan Vaja <rajan.vaja@xilinx.com>
    Link: https://lore.kernel.org/r/1612765883-22018-1-git-send-email-rajan.vaja@xilinx.com
    Signed-off-by: Michal Simek <michal.simek@xilinx.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/firmware/xilinx/zynqmp.c | 5 +++--
    1 file changed, 3 insertions(+), 2 deletions(-)

    diff --git a/drivers/firmware/xilinx/zynqmp.c b/drivers/firmware/xilinx/zynqmp.c
    index fd95edeb702b..9e6504592646 100644
    --- a/drivers/firmware/xilinx/zynqmp.c
    +++ b/drivers/firmware/xilinx/zynqmp.c
    @@ -2,7 +2,7 @@
    /*
    * Xilinx Zynq MPSoC Firmware layer
    *
    - * Copyright (C) 2014-2020 Xilinx, Inc.
    + * Copyright (C) 2014-2021 Xilinx, Inc.
    *
    * Michal Simek <michal.simek@xilinx.com>
    * Davorin Mista <davorin.mista@aggios.com>
    @@ -1280,12 +1280,13 @@ static int zynqmp_firmware_probe(struct platform_device *pdev)
    static int zynqmp_firmware_remove(struct platform_device *pdev)
    {
    struct pm_api_feature_data *feature_data;
    + struct hlist_node *tmp;
    int i;

    mfd_remove_devices(&pdev->dev);
    zynqmp_pm_api_debugfs_exit();

    - hash_for_each(pm_api_features_map, i, feature_data, hentry) {
    + hash_for_each_safe(pm_api_features_map, i, tmp, feature_data, hentry) {
    hash_del(&feature_data->hentry);
    kfree(feature_data);
    }
    --
    2.30.2


    \
     
     \ /
      Last update: 2021-05-12 18:02    [W:3.409 / U:0.048 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site