Commit ec1fcddb authored by Wentao Liang's avatar Wentao Liang Committed by Ulf Hansson
Browse files

pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() 



In scpsys_get_bus_protection_legacy(), of_find_node_with_property()
returns a device node with its reference count incremented. The function
then calls of_node_put(node) before checking whether
syscon_regmap_lookup_by_phandle() returns an error. If an error occurs,
dev_err_probe() dereferences the node pointer to print diagnostic
information, but the node memory may have already been freed due to the
earlier of_node_put(), leading to a use-after-free vulnerability.

Fix this by moving the of_node_put() call after the error check, ensuring
the node is still valid when accessed in the error path.

Fixes: c29345fa ("pmdomain: mediatek: Refactor bus protection regmaps retrieval")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarWentao Liang <vulab@iscas.ac.cn>
Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
parent 26735dfd

drivers/pmdomain/mediatek/mtk-pm-domains.c

+7 −3
Original line number Diff line number Diff line
@@ -1015,6 +1015,7 @@ static int scpsys_get_bus_protection_legacy(struct device *dev, struct scpsys *s 
	struct device_node *node, *smi_np;

	int num_regmaps = 0, i, j;

	struct regmap *regmap[3];

	int ret = 0;



	/*

	 * Legacy code retrieves a maximum of three bus protection handles:
@@ -1065,11 +1066,14 @@ static int scpsys_get_bus_protection_legacy(struct device *dev, struct scpsys *s 
	if (node) {

		regmap[2] = syscon_regmap_lookup_by_phandle(node, "mediatek,infracfg-nao");

		num_regmaps++;

		of_node_put(node);

		if (IS_ERR(regmap[2]))

			return dev_err_probe(dev, PTR_ERR(regmap[2]),

		if (IS_ERR(regmap[2])) {

			ret = dev_err_probe(dev, PTR_ERR(regmap[2]),

					     "%pOF: failed to get infracfg regmap\n",

					     node);

			of_node_put(node);

			return ret;

		}

		of_node_put(node);

	} else {

		regmap[2] = NULL;

	}