From: Ulf Hansson <ulf.hansson@linaro.org>
To: Wentao Liang <vulab@iscas.ac.cn>
Cc: Matthias Brugger <matthias.bgg@gmail.com>,
AngeloGioacchino Del Regno
<angelogioacchino.delregno@collabora.com>,
nfraprado@collabora.com, Macpaul Lin <macpaul.lin@mediatek.com>,
Adam Ford <aford173@gmail.com>,
Chen-Yu Tsai <wenst@chromium.org>,
linux-pm@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-arm-kernel@lists.infradead.org,
linux-mediatek@lists.infradead.org, stable@vger.kernel.org
Subject: Re: [PATCH] pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy()
Date: Mon, 27 Apr 2026 15:13:12 +0200 [thread overview]
Message-ID: <CAPDyKFrTG6tp9XbuiUYjgMYkHYQwVsyXBuggCc3Lp=J_NcKTyA@mail.gmail.com> (raw)
In-Reply-To: <20260408141121.386522-1-vulab@iscas.ac.cn>
On Wed, 8 Apr 2026 at 16:11, Wentao Liang <vulab@iscas.ac.cn> wrote:
>
> In scpsys_get_bus_protection_legacy(), of_find_node_with_property()
> returns a device node with its reference count incremented. The function
> then calls of_node_put(node) before checking whether
> syscon_regmap_lookup_by_phandle() returns an error. If an error occurs,
> dev_err_probe() dereferences the node pointer to print diagnostic
> information, but the node memory may have already been freed due to the
> earlier of_node_put(), leading to a use-after-free vulnerability.
>
> Fix this by moving the of_node_put() call after the error check, ensuring
> the node is still valid when accessed in the error path.
>
> Fixes: c29345fa5f66 ("pmdomain: mediatek: Refactor bus protection regmaps retrieval")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Applied for fixes, thanks!
Kind regards
Uffe
> ---
> drivers/pmdomain/mediatek/mtk-pm-domains.c | 10 +++++++---
> 1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/pmdomain/mediatek/mtk-pm-domains.c b/drivers/pmdomain/mediatek/mtk-pm-domains.c
> index e2800aa1bc59..d3b36f32417c 100644
> --- a/drivers/pmdomain/mediatek/mtk-pm-domains.c
> +++ b/drivers/pmdomain/mediatek/mtk-pm-domains.c
> @@ -993,6 +993,7 @@ static int scpsys_get_bus_protection_legacy(struct device *dev, struct scpsys *s
> struct device_node *node, *smi_np;
> int num_regmaps = 0, i, j;
> struct regmap *regmap[3];
> + int ret = 0;
>
> /*
> * Legacy code retrieves a maximum of three bus protection handles:
> @@ -1043,11 +1044,14 @@ static int scpsys_get_bus_protection_legacy(struct device *dev, struct scpsys *s
> if (node) {
> regmap[2] = syscon_regmap_lookup_by_phandle(node, "mediatek,infracfg-nao");
> num_regmaps++;
> - of_node_put(node);
> - if (IS_ERR(regmap[2]))
> - return dev_err_probe(dev, PTR_ERR(regmap[2]),
> + if (IS_ERR(regmap[2])) {
> + ret = dev_err_probe(dev, PTR_ERR(regmap[2]),
> "%pOF: failed to get infracfg regmap\n",
> node);
> + of_node_put(node);
> + return ret;
> + }
> + of_node_put(node);
> } else {
> regmap[2] = NULL;
> }
> --
> 2.34.1
>
prev parent reply other threads:[~2026-04-27 13:13 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-08 14:11 [PATCH] pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() Wentao Liang
2026-04-27 13:13 ` Ulf Hansson [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAPDyKFrTG6tp9XbuiUYjgMYkHYQwVsyXBuggCc3Lp=J_NcKTyA@mail.gmail.com' \
--to=ulf.hansson@linaro.org \
--cc=aford173@gmail.com \
--cc=angelogioacchino.delregno@collabora.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mediatek@lists.infradead.org \
--cc=linux-pm@vger.kernel.org \
--cc=macpaul.lin@mediatek.com \
--cc=matthias.bgg@gmail.com \
--cc=nfraprado@collabora.com \
--cc=stable@vger.kernel.org \
--cc=vulab@iscas.ac.cn \
--cc=wenst@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).