irqchip/renesas-rza1: Prevent use-after-free in rza1_irqc_probe() (7c8e90dd) · Commits · 戴 / test

The gic_node is still being used in the rza1_irqc_parse_map() call after the of_node_put() call, which may result in use-after-free. Fixes: ("irqchip: Add Renesas RZ/A1 Interrupt Controller driver") Signed-off-by:

Wen Yang <wen.yang99@zte.com.cn> Signed-off-by:

Thomas Gleixner <tglx@linutronix.de> Reviewed-by:

Geert Uytterhoeven <geert+renesas@glider.be> Link: https://lkml.kernel.org/r/1562566745-7447-3-git-send-email-wen.yang99@zte.com.cn

drivers/irqchip/irq-renesas-rza1.c

+8 −7

Original line number	Diff line number	Diff line
		@@ -208,20 +208,19 @@ static int rza1_irqc_probe(struct platform_device *pdev)
		return PTR_ERR(priv->base);

		gic_node = of_irq_find_parent(np);
		if (gic_node) {
		if (gic_node)
		parent = irq_find_host(gic_node);
		of_node_put(gic_node);
		}

		if (!parent) {
		dev_err(dev, "cannot find parent domain\n");
		return -ENODEV;
		ret = -ENODEV;
		goto out_put_node;
		}

		ret = rza1_irqc_parse_map(priv, gic_node);
		if (ret) {
		dev_err(dev, "cannot parse %s: %d\n", "interrupt-map", ret);
		return ret;
		goto out_put_node;
		}

		priv->chip.name = "rza1-irqc",
		@@ -237,10 +236,12 @@ static int rza1_irqc_probe(struct platform_device *pdev)
		priv);
		if (!priv->irq_domain) {
		dev_err(dev, "cannot initialize irq domain\n");
		return -ENOMEM;
		ret = -ENOMEM;
		}

		return 0;
		out_put_node:
		of_node_put(gic_node);
		return ret;
		}

		static int rza1_irqc_remove(struct platform_device *pdev)

Admin message