| Message ID | 0793fbd1-d2b5-4ec2-9403-3c39343a3e2d@kili.mountain (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | clk: imx: scu: use _safe list iterator to avoid a use after free | expand |
On 23-04-19 17:23:01, Dan Carpenter wrote: > This loop is freeing "clk" so it needs to use list_for_each_entry_safe(). > Otherwise it dereferences a freed variable to get the next item on the > loop. > > Fixes: 77d8f3068c63 ("clk: imx: scu: add two cells binding support") > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Abel Vesa <abel.vesa@linaro.org> > --- > drivers/clk/imx/clk-scu.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/clk/imx/clk-scu.c b/drivers/clk/imx/clk-scu.c > index 1e6870f3671f..db307890e4c1 100644 > --- a/drivers/clk/imx/clk-scu.c > +++ b/drivers/clk/imx/clk-scu.c > @@ -707,11 +707,11 @@ struct clk_hw *imx_clk_scu_alloc_dev(const char *name, > > void imx_clk_scu_unregister(void) > { > - struct imx_scu_clk_node *clk; > + struct imx_scu_clk_node *clk, *n; > int i; > > for (i = 0; i < IMX_SC_R_LAST; i++) { > - list_for_each_entry(clk, &imx_scu_clks[i], node) { > + list_for_each_entry_safe(clk, n, &imx_scu_clks[i], node) { > clk_hw_unregister(clk->hw); > kfree(clk); > } > -- > 2.39.2 >
On Wed, 19 Apr 2023 17:23:01 +0300, Dan Carpenter wrote: > This loop is freeing "clk" so it needs to use list_for_each_entry_safe(). > Otherwise it dereferences a freed variable to get the next item on the > loop. > > Applied, thanks! [1/1] clk: imx: scu: use _safe list iterator to avoid a use after free commit: 632c60ecd25dbacee54d5581fe3aeb834b57010a Best regards,
diff --git a/drivers/clk/imx/clk-scu.c b/drivers/clk/imx/clk-scu.c index 1e6870f3671f..db307890e4c1 100644 --- a/drivers/clk/imx/clk-scu.c +++ b/drivers/clk/imx/clk-scu.c @@ -707,11 +707,11 @@ struct clk_hw *imx_clk_scu_alloc_dev(const char *name, void imx_clk_scu_unregister(void) { - struct imx_scu_clk_node *clk; + struct imx_scu_clk_node *clk, *n; int i; for (i = 0; i < IMX_SC_R_LAST; i++) { - list_for_each_entry(clk, &imx_scu_clks[i], node) { + list_for_each_entry_safe(clk, n, &imx_scu_clks[i], node) { clk_hw_unregister(clk->hw); kfree(clk); }
This loop is freeing "clk" so it needs to use list_for_each_entry_safe(). Otherwise it dereferences a freed variable to get the next item on the loop. Fixes: 77d8f3068c63 ("clk: imx: scu: add two cells binding support") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> --- drivers/clk/imx/clk-scu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)