Patch "reset: Fix crash when freeing non-existent optional resets" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    reset: Fix crash when freeing non-existent optional resets

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     reset-fix-crash-when-freeing-non-existent-optional-r.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit ee8b8ec3b2d303b72c731d3adb8699344e93e9d9
Author: Geert Uytterhoeven <geert+renesas@xxxxxxxxx>
Date:   Wed Nov 29 17:55:33 2023 +0100

    reset: Fix crash when freeing non-existent optional resets
    
    [ Upstream commit 4a6756f56bcf8e64c87144a626ce53aea4899c0e ]
    
    When obtaining one or more optional resets, non-existent resets are
    stored as NULL pointers, and all related error and cleanup paths need to
    take this into account.
    
    Currently only reset_control_put() and reset_control_bulk_put()
    get this right.  All of __reset_control_bulk_get(),
    of_reset_control_array_get(), and reset_control_array_put() lack the
    proper checking, causing NULL pointer dereferences on failure or
    release.
    
    Fix this by moving the existing check from reset_control_bulk_put() to
    __reset_control_put_internal(), so it applies to all callers.
    The double check in reset_control_put() doesn't hurt.
    
    Fixes: 17c82e206d2a3cd8 ("reset: Add APIs to manage array of resets")
    Fixes: 48d71395896d54ee ("reset: Add reset_control_bulk API")
    Signed-off-by: Geert Uytterhoeven <geert+renesas@xxxxxxxxx>
    Link: https://lore.kernel.org/r/2440edae7ca8534628cdbaf559ded288f2998178.1701276806.git.geert+renesas@xxxxxxxxx
    Signed-off-by: Philipp Zabel <p.zabel@xxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/reset/core.c b/drivers/reset/core.c
index 61e6888826432..320412e513c07 100644
--- a/drivers/reset/core.c
+++ b/drivers/reset/core.c
@@ -806,6 +806,9 @@ static void __reset_control_put_internal(struct reset_control *rstc)
 {
 	lockdep_assert_held(&reset_list_mutex);
 
+	if (IS_ERR_OR_NULL(rstc))
+		return;
+
 	kref_put(&rstc->refcnt, __reset_control_release);
 }
 
@@ -1016,11 +1019,8 @@ EXPORT_SYMBOL_GPL(reset_control_put);
 void reset_control_bulk_put(int num_rstcs, struct reset_control_bulk_data *rstcs)
 {
 	mutex_lock(&reset_list_mutex);
-	while (num_rstcs--) {
-		if (IS_ERR_OR_NULL(rstcs[num_rstcs].rstc))
-			continue;
+	while (num_rstcs--)
 		__reset_control_put_internal(rstcs[num_rstcs].rstc);
-	}
 	mutex_unlock(&reset_list_mutex);
 }
 EXPORT_SYMBOL_GPL(reset_control_bulk_put);