Patch "clk: imx: scu: use _safe list iterator to avoid a use after free" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    clk: imx: scu: use _safe list iterator to avoid a use after free

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     clk-imx-scu-use-_safe-list-iterator-to-avoid-a-use-a.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit bf15436628fed417d99db816626fb64ba011b5d1
Author: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Date:   Wed Apr 19 17:23:01 2023 +0300

    clk: imx: scu: use _safe list iterator to avoid a use after free
    
    [ Upstream commit 632c60ecd25dbacee54d5581fe3aeb834b57010a ]
    
    This loop is freeing "clk" so it needs to use list_for_each_entry_safe().
    Otherwise it dereferences a freed variable to get the next item on the
    loop.
    
    Fixes: 77d8f3068c63 ("clk: imx: scu: add two cells binding support")
    Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
    Reviewed-by: Abel Vesa <abel.vesa@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/0793fbd1-d2b5-4ec2-9403-3c39343a3e2d@kili.mountain
    Signed-off-by: Abel Vesa <abel.vesa@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/clk/imx/clk-scu.c b/drivers/clk/imx/clk-scu.c
index dc933fd5d5a0f..1cee88b073fa2 100644
--- a/drivers/clk/imx/clk-scu.c
+++ b/drivers/clk/imx/clk-scu.c
@@ -702,11 +702,11 @@ struct clk_hw *imx_clk_scu_alloc_dev(const char *name,
 
 void imx_clk_scu_unregister(void)
 {
-	struct imx_scu_clk_node *clk;
+	struct imx_scu_clk_node *clk, *n;
 	int i;
 
 	for (i = 0; i < IMX_SC_R_LAST; i++) {
-		list_for_each_entry(clk, &imx_scu_clks[i], node) {
+		list_for_each_entry_safe(clk, n, &imx_scu_clks[i], node) {
 			clk_hw_unregister(clk->hw);
 			kfree(clk);
 		}