From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753394AbbJSJ2B (ORCPT ); Mon, 19 Oct 2015 05:28:01 -0400 Received: from ozlabs.org ([103.22.144.67]:44355 "EHLO ozlabs.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752564AbbJSJ2A (ORCPT ); Mon, 19 Oct 2015 05:28:00 -0400 Message-ID: <1445246877.30407.1.camel@ellerman.id.au> Subject: Re: [PATCH v2] powerpc/prom: Avoid reference to potentially freed memory From: Michael Ellerman To: Christophe JAILLET , benh@kernel.crashing.org, paulus@samba.org Cc: linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org Date: Mon, 19 Oct 2015 20:27:57 +1100 In-Reply-To: <1445031525-20086-1-git-send-email-christophe.jaillet@wanadoo.fr> References: <1444976055-19148-1-git-send-email-christophe.jaillet@wanadoo.fr> <1445031525-20086-1-git-send-email-christophe.jaillet@wanadoo.fr> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.16.5-1ubuntu2 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, 2015-10-16 at 23:38 +0200, Christophe JAILLET wrote: > of_get_property() is used inside the loop, but then the reference to the > node is dropped before dereferencing the prop pointer, which could by then > point to junk if the node has been freed. > > Instead use of_property_read_u32() to actually read the property > value before dropping the reference. > > Signed-off-by: Christophe JAILLET > --- > v2: Fix missing '{' > *** COMPILE-TESTED ONLY *** Thanks, this looks good. I'll test it on real hardware. Can you send me a follow up which does the of_get_next_parent() conversion? cheers