From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ed1-f44.google.com (mail-ed1-f44.google.com [209.85.208.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8C41D3FF882 for ; Wed, 10 Jun 2026 10:58:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=209.85.208.44 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781089117; cv=pass; b=a6Q8SQ+YEldIWzr3JvCYQLjN57lIbrvRJbzScGnSYLnBGXPwVEJrju359+iFtwPWLS4EOmkDkISG5/dOwgfaJ3q3VJACmDFtIqxI6yEzsK0bNSpnF7jFcXqSMgxZETwmNf64CGTQTiC3Yo94yYVIkj9kwXe5xEe8RQxBiHMfeYA= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781089117; c=relaxed/simple; bh=IsH/o3sokzqOos212l12PDYiFKlklnRFmICJnS027rw=; h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=YjjRg5d7mcGDBo6kYb63B7Fwv1y0Hd5dM/JyG1sVnezHZ6/kc+VhsDxLQeZ3/5XjyJCJ9jp48FWfKO2G2l0h1gZfuclYRTD9gesWxNhFMVCxqlVdgUNyDeUI9VaMBBM1QgFm99cWVLhGHxxDK613+7VIb4bJyIcolYhyprmA8j8= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org; spf=pass smtp.mailfrom=linaro.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b=r7rIU4FO; arc=pass smtp.client-ip=209.85.208.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linaro.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b="r7rIU4FO" Received: by mail-ed1-f44.google.com with SMTP id 4fb4d7f45d1cf-68cec9f4c6cso9268383a12.0 for ; Wed, 10 Jun 2026 03:58:31 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1781089110; cv=none; d=google.com; s=arc-20240605; b=N7V393c0VFo8dFf4pPu1UJKQNaqUq5ZSnPFxPZ5W6hTiHvvNtnxoa6TmqRuo4MambU XQEJQJ9VnlSEN/w8dzBvTFySWLLTyopLhen33aUr5CbCy/ZiRiQSZoin5OTY/1OiaGaE eup1p3tOQUNVwnD2KhwDne+Lllix8Rt0hDg12aIiglB+VENDD225GrC3KO1pbvi+7S0s UYFmv8SQo/VyMd7yNoCH15bAfbzOlRkg1SUV4mnx8nS+ZShHbrxZxwdhZ+T02KTCvLVH MlDUSlfGbEorhvVjZEyj0kNg5CDNNuDuGfgsQTY2DvdhFKXhON5YDr+mmZ8pLhzRuLbh AUDg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:dkim-signature; bh=CZevPFZWYMUUhq47/UQyoxjI9SWdGG7Ind6IJjxpI3Y=; fh=qt7AdJ61GF0Qe0HXK7I/kSDwqywJJXDRM/521w/EqIc=; b=fGeHC8QaeffdkUGONfgcmvqncNnXMb/EBGa1df69UVL+ahNDtWBYMRAng3yZsxfarW zY452tOA5sU5+CVnUlDQktj3C8SY640If4Q730gXWd1036+pbVuS9nvlE1Zk0Nt74E3k ++/jnFFJnQjS1X+IEaZdTTgAVzkuelf2jGt5HwHhux0TEctsjcuuJ0xF7qVVXFgYL+QL wcblEUFG+Rw5HbbqTnoHd+ksH0vILqJ0/Y1loHEinB+IMXA02UCBPdDFfSsUCN2cLZA0 AVwVuxqoaT3eI275CT8RgPG/L94XH8mPb0GWV9ZMYiUxLPkkrHHSyiRpe92fPInHYkG1 YwQQ==; darn=vger.kernel.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1781089110; x=1781693910; darn=vger.kernel.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=CZevPFZWYMUUhq47/UQyoxjI9SWdGG7Ind6IJjxpI3Y=; b=r7rIU4FOd7qobXnqxhwQnjMwuijY0UTSRUt+Q80H+ICNXeK6ut2PpyNgZvjutvci2W 4kNIt8pWtdJlAEwDffMehiElVm3t4JFVd73zR1eGXFMSh4V+wvwzueV3nDVx0R0wvfcy KpLjvp2yihv/pSGFKcbNmiu7IxkFT+vG8rZgrMxQdpuJuwHfE6IL+ZUGNkD+rfvNTGL/ Y9HkI8nFqEFmT9W4vcDPErSuU1DepSIq51I0u256eVvecnL8N5q1fzNHatTnLX/mGaQA SPTcBl19eb1R1SW8+wurKGUVunm4bG0DwYV5s8AYPzM/bNs4/M592hr6Av8CdD0w+uUx FvCw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781089110; x=1781693910; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=CZevPFZWYMUUhq47/UQyoxjI9SWdGG7Ind6IJjxpI3Y=; b=QsfXij4eyT1XRXU7ATnEC2Wk0jaMO7KrTnyFr3x6H5hAbC7D76niHbgnXjBkv4mefV bNL39TxaHpcGtcG4G7PifDzX4eX27XQLYrCQWhdFX+zsn1McXEdP+FlyfiBMVUjdxc7N exMBGyuBX0kwEd4IF4eG5cNzNI+4dd7VswJJ0PvkjrmRDStfHpF7jkiPOQLbfLad1cAC +z29ng7LLSSMy7+COEWscObt+QL9asMKf7v9iArULgtoW18wL7PX47MZLmQMcrgONQt0 me152Vb6N3WHdANLL3wRj3YMZ69tKRe0xLbnaamhdrHh0K8n8I4S5Io1XPLUNE0x5P0j hmKg== X-Forwarded-Encrypted: i=1; AFNElJ8h8v6rXUMpmnR5F2rV4UpWujnmKFWhQV5mYf2wRi0KBaSB/IwNskcdYLbh7fsGhWjQXKEJAqVTTjF/zxM=@vger.kernel.org X-Gm-Message-State: AOJu0YwonqJDN0QNK1s21E3WgjiSbsfDeXuX5o3G2XTZhavQYLC/K4L8 oPkQL6idOXvX/VVTaXylCtR2GRBWTBCme+MAdv1xoQIGSBq6iixqa2RXaDjKWi2dljt5/b4aVKa K1ov1u7NlLBrnEYx9GRNvR3SaxwpWUAHRjlrbpxVGRA== X-Gm-Gg: Acq92OFn6i33dIkg8qYPzGaWJz/P+Mt3krFXgq+egJY4TIQzjRmxytLrZNlTYcbbLtb nElzGBvI43dZqWnjqpDvrWu7fvR4tI8viADsBzEzYpbJjPAB9JSu7PEYYA53dPXedVltTsbuBz1 osdhCOWFEFA2mw5CB0Wpa+4BH+BVudGe3q4wCwGHdxrEipzVrgJNE3aW5u1bdb9DCwBptUTvuyW Zg3uQs5LWjBLAafBNbrxSn7TLmxMYYj1UW10V7wgVAtw4GjDnffYgHZl11jOkW7cXnfjBZLVW7t eIjmV/cRVlY9mWA7T/A74jKIZ2ZbcEgQqtTKt/khq3el31Cfvjme X-Received: by 2002:a05:6402:3711:b0:691:ad29:ea20 with SMTP id 4fb4d7f45d1cf-691ad29ec32mr8237260a12.14.1781089109643; Wed, 10 Jun 2026 03:58:29 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 References: <20260605-exynos-pmu-cpuhp-idle-fixes-v1-0-0cd05c81a82d@linaro.org> <20260605-exynos-pmu-cpuhp-idle-fixes-v1-2-0cd05c81a82d@linaro.org> In-Reply-To: <20260605-exynos-pmu-cpuhp-idle-fixes-v1-2-0cd05c81a82d@linaro.org> From: Peter Griffin Date: Wed, 10 Jun 2026 11:58:18 +0100 X-Gm-Features: AVVi8Cc8CtqeDsBexbU73aNUL0ZdHbMknGnH8Y2ORIFe_Si6C0zGr-kM3HOWHug Message-ID: Subject: Re: [PATCH 2/3] soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node To: Alexey Klimov Cc: Krzysztof Kozlowski , Alim Akhtar , Sam Protsenko , linux-samsung-soc@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Sashiko Content-Type: text/plain; charset="UTF-8" Hi Alexey, Thanks for your patch. On Fri, 5 Jun 2026 at 21:19, Alexey Klimov wrote: > > The setup_cpuhp_and_cpuidle() parses the device tree node for the > interrupt generation block via of_parse_phandle() and decrements its > reference count using of_node_put() immediately after fetching the resource > address. However, later the intr_gen_node pointer is passed into > of_syscon_register_regmap(). > > Fix this by moving the of_node_put() invocation to after the > of_syscon_register_regmap() call, and adding it to correct error paths. I think using __free(device_node) = of_parse_phandle would be a cleaner/simpler fix. Peter Peter. > > Reported-by: Sashiko > Closes: https://sashiko.dev/#/patchset/20260513-exynos850-cpuhotplug-v4-0-54fec5f65362@linaro.org?part=3 > Fixes: 78b72897a5c8 ("soc: samsung: exynos-pmu: Enable CPU Idle for gs101") > Cc: stable@vger.kernel.org > Signed-off-by: Alexey Klimov > --- > drivers/soc/samsung/exynos-pmu.c | 11 +++++++++-- > 1 file changed, 9 insertions(+), 2 deletions(-) > > diff --git a/drivers/soc/samsung/exynos-pmu.c b/drivers/soc/samsung/exynos-pmu.c > index 6e635872247a..9636287f6794 100644 > --- a/drivers/soc/samsung/exynos-pmu.c > +++ b/drivers/soc/samsung/exynos-pmu.c > @@ -428,23 +428,30 @@ static int setup_cpuhp_and_cpuidle(struct device *dev) > * syscon provided regmap. > */ > ret = of_address_to_resource(intr_gen_node, 0, &intrgen_res); > - of_node_put(intr_gen_node); > + if (ret) { > + of_node_put(intr_gen_node); > + return ret; > + } > > virt_addr = devm_ioremap(dev, intrgen_res.start, > resource_size(&intrgen_res)); > - if (!virt_addr) > + if (!virt_addr) { > + of_node_put(intr_gen_node); > return -ENOMEM; > + } > > pmu_context->pmuintrgen = devm_regmap_init_mmio(dev, virt_addr, > ®map_pmu_intr); > if (IS_ERR(pmu_context->pmuintrgen)) { > dev_err(dev, "failed to initialize pmu-intr-gen regmap\n"); > + of_node_put(intr_gen_node); > return PTR_ERR(pmu_context->pmuintrgen); > } > > /* register custom mmio regmap with syscon */ > ret = of_syscon_register_regmap(intr_gen_node, > pmu_context->pmuintrgen); > + of_node_put(intr_gen_node); > if (ret) > return ret; > > > -- > 2.51.0 >