Commit c58da0ba authored by Dan Carpenter's avatar Dan Carpenter Committed by Michal Simek
Browse files

driver: soc: xilinx: use _safe loop iterator to avoid a use after free 



The hash_for_each_possible() loop dereferences "eve_data" to get the
next item on the list.  However the loop frees eve_data so it leads to
a use after free.  Use hash_for_each_possible_safe() instead.

Fixes: c7fdb240 ("drivers: soc: xilinx: add xilinx event management driver")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/761e0e4a-4caf-4a71-8f47-1c6ad908a848@kili.mountain


Signed-off-by: default avatarMichal Simek <michal.simek@amd.com>
parent be11d67a

drivers/soc/xilinx/xlnx_event_manager.c

+4 −2
Original line number Diff line number Diff line
@@ -192,11 +192,12 @@ static int xlnx_remove_cb_for_suspend(event_cb_func_t cb_fun) 
	struct registered_event_data *eve_data;

	struct agent_cb *cb_pos;

	struct agent_cb *cb_next;

	struct hlist_node *tmp;



	is_need_to_unregister = false;



	/* Check for existing entry in hash table for given cb_type */

	hash_for_each_possible(reg_driver_map, eve_data, hentry, PM_INIT_SUSPEND_CB) {

	hash_for_each_possible_safe(reg_driver_map, eve_data, tmp, hentry, PM_INIT_SUSPEND_CB) {

		if (eve_data->cb_type == PM_INIT_SUSPEND_CB) {

			/* Delete the list of callback */

			list_for_each_entry_safe(cb_pos, cb_next, &eve_data->cb_list_head, list) {
@@ -228,11 +229,12 @@ static int xlnx_remove_cb_for_notify_event(const u32 node_id, const u32 event, 
	u64 key = ((u64)node_id << 32U) | (u64)event;

	struct agent_cb *cb_pos;

	struct agent_cb *cb_next;

	struct hlist_node *tmp;



	is_need_to_unregister = false;



	/* Check for existing entry in hash table for given key id */

	hash_for_each_possible(reg_driver_map, eve_data, hentry, key) {

	hash_for_each_possible_safe(reg_driver_map, eve_data, tmp, hentry, key) {

		if (eve_data->key == key) {

			/* Delete the list of callback */

			list_for_each_entry_safe(cb_pos, cb_next, &eve_data->cb_list_head, list) {