diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2018-04-27 17:06:49 +0300 |
|---|---|---|
| committer | Sudeep Holla <sudeep.holla@arm.com> | 2018-05-08 18:03:47 +0100 |
| commit | 31c6085562a03124d3f6a5c43dd9888ac44495a5 (patch) | |
| tree | f092434a6a5f46d530de3c61bd33e520cdc666e9 /drivers/firmware | |
| parent | 60cc43fc888428bb2f18f08997432d426a243338 (diff) | |
| download | op-kernel-dev-31c6085562a03124d3f6a5c43dd9888ac44495a5.zip op-kernel-dev-31c6085562a03124d3f6a5c43dd9888ac44495a5.tar.gz | |
firmware: arm_scmi: Use after free in scmi_create_protocol_device()
We need to return here instead of setting up the freed sdev device as a
transport.
Fixes: 907b6d14911d ("firmware: arm_scmi: add per-protocol channels support using idr objects")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Diffstat (limited to 'drivers/firmware')
| -rw-r--r-- | drivers/firmware/arm_scmi/driver.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c index 14b1471..2455be8 100644 --- a/drivers/firmware/arm_scmi/driver.c +++ b/drivers/firmware/arm_scmi/driver.c @@ -778,6 +778,7 @@ scmi_create_protocol_device(struct device_node *np, struct scmi_info *info, if (scmi_mbox_chan_setup(info, &sdev->dev, prot_id)) { dev_err(&sdev->dev, "failed to setup transport\n"); scmi_device_destroy(sdev); + return; } /* setup handle now as the transport is ready */ |
