Patch "reset: Fix crash when freeing non-existent optional resets" has been added to the 4.19-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    reset: Fix crash when freeing non-existent optional resets

to the 4.19-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     reset-fix-crash-when-freeing-non-existent-optional-r.patch
and it can be found in the queue-4.19 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit ee854c1285102b29dbfab8d1cf2c4cc6c87f5bee
Author: Geert Uytterhoeven <geert+renesas@xxxxxxxxx>
Date:   Wed Nov 29 17:55:33 2023 +0100

    reset: Fix crash when freeing non-existent optional resets
    
    [ Upstream commit 4a6756f56bcf8e64c87144a626ce53aea4899c0e ]
    
    When obtaining one or more optional resets, non-existent resets are
    stored as NULL pointers, and all related error and cleanup paths need to
    take this into account.
    
    Currently only reset_control_put() and reset_control_bulk_put()
    get this right.  All of __reset_control_bulk_get(),
    of_reset_control_array_get(), and reset_control_array_put() lack the
    proper checking, causing NULL pointer dereferences on failure or
    release.
    
    Fix this by moving the existing check from reset_control_bulk_put() to
    __reset_control_put_internal(), so it applies to all callers.
    The double check in reset_control_put() doesn't hurt.
    
    Fixes: 17c82e206d2a3cd8 ("reset: Add APIs to manage array of resets")
    Fixes: 48d71395896d54ee ("reset: Add reset_control_bulk API")
    Signed-off-by: Geert Uytterhoeven <geert+renesas@xxxxxxxxx>
    Link: https://lore.kernel.org/r/2440edae7ca8534628cdbaf559ded288f2998178.1701276806.git.geert+renesas@xxxxxxxxx
    Signed-off-by: Philipp Zabel <p.zabel@xxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/reset/core.c b/drivers/reset/core.c
index ccb97f4e31c38..1680d27040c9b 100644
--- a/drivers/reset/core.c
+++ b/drivers/reset/core.c
@@ -459,6 +459,9 @@ static void __reset_control_put_internal(struct reset_control *rstc)
 {
 	lockdep_assert_held(&reset_list_mutex);
 
+	if (IS_ERR_OR_NULL(rstc))
+		return;
+
 	kref_put(&rstc->refcnt, __reset_control_release);
 }
 




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux