Commit 19f516ea authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm 

Pull ARM fix from Russell King:
 "Just one fix for now for the AMBA bus code from Isaac Manjarres"

* tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm:
  ARM: 9229/1: amba: Fix use-after-free in amba_read_periphid()
parents d2ec799d 25af7406

drivers/amba/bus.c

+7 −1
Original line number Diff line number Diff line
@@ -209,6 +209,7 @@ static int amba_match(struct device *dev, struct device_driver *drv) 
	struct amba_device *pcdev = to_amba_device(dev);

	struct amba_driver *pcdrv = to_amba_driver(drv);



	mutex_lock(&pcdev->periphid_lock);

	if (!pcdev->periphid) {

		int ret = amba_read_periphid(pcdev);
@@ -218,11 +219,14 @@ static int amba_match(struct device *dev, struct device_driver *drv) 
		 * permanent failure in reading pid and cid, simply map it to

		 * -EPROBE_DEFER.

		 */

		if (ret)

		if (ret) {

			mutex_unlock(&pcdev->periphid_lock);

			return -EPROBE_DEFER;

		}

		dev_set_uevent_suppress(dev, false);

		kobject_uevent(&dev->kobj, KOBJ_ADD);

	}

	mutex_unlock(&pcdev->periphid_lock);



	/* When driver_override is set, only bind to the matching driver */

	if (pcdev->driver_override)
@@ -532,6 +536,7 @@ static void amba_device_release(struct device *dev) 


	if (d->res.parent)

		release_resource(&d->res);

	mutex_destroy(&d->periphid_lock);

	kfree(d);

}
@@ -584,6 +589,7 @@ static void amba_device_initialize(struct amba_device *dev, const char *name) 
	dev->dev.dma_mask = &dev->dev.coherent_dma_mask;

	dev->dev.dma_parms = &dev->dma_parms;

	dev->res.name = dev_name(&dev->dev);

	mutex_init(&dev->periphid_lock);

}



/**

include/linux/amba/bus.h

+1 −0
Original line number Diff line number Diff line
@@ -67,6 +67,7 @@ struct amba_device { 
	struct clk		*pclk;

	struct device_dma_parameters dma_parms;

	unsigned int		periphid;

	struct mutex		periphid_lock;

	unsigned int		cid;

	struct amba_cs_uci_id	uci;

	unsigned int		irq[AMBA_NR_IRQS];