mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-02 15:18:19 +00:00
Code Issues Releases Wiki Activity

ACPI / CPPC: Fix per-CPU pointer management in acpi_cppc_processor_probe()

Browse source 
Fix a possible use-after-free scenario in acpi_cppc_processor_probe()
that can happen if the function returns without cleaning up the
per-CPU pointer set by it previously.

Reported-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
This commit is contained in:
Rafael J. Wysocki 2016-12-10 00:52:28 +01:00
parent 9e9d68dad5
commit 28076483af
1 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
drivers/acpi/cppc_acpi.c
View file

@ -776,9 +776,6 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr)
init_waitqueue_head(&pcc_data.pcc_write_wait_q); init_waitqueue_head(&pcc_data.pcc_write_wait_q);
} }
/* Plug PSD data into this CPUs CPC descriptor. */
per_cpu(cpc_desc_ptr, pr->id) = cpc_ptr;
/* Everything looks okay */ /* Everything looks okay */
pr_debug("Parsed CPC struct for CPU: %d\n", pr->id); pr_debug("Parsed CPC struct for CPU: %d\n", pr->id);
@ -789,10 +786,15 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr)
goto out_free; goto out_free;
} }
/* Plug PSD data into this CPUs CPC descriptor. */
per_cpu(cpc_desc_ptr, pr->id) = cpc_ptr;
ret = kobject_init_and_add(&cpc_ptr->kobj, &cppc_ktype, &cpu_dev->kobj, ret = kobject_init_and_add(&cpc_ptr->kobj, &cppc_ktype, &cpu_dev->kobj,
"acpi_cppc"); "acpi_cppc");
if (ret) if (ret) {
per_cpu(cpc_desc_ptr, pr->id) = NULL;
goto out_free; goto out_free;
}
kfree(output.pointer); kfree(output.pointer);
return 0; return 0;