Re: [PATCH] cpufreq: scmi: fix use-after-free in scmi_cpufreq_exit()

[Viresh Kumar]

On 16-02-19, 11:31, Yangtao Li wrote:
> This issue was detected with the help of Coccinelle. So
> change the order of function calls to fix it.
> 
> Fixes: 1690d8bb91e37 (cpufreq: scpi/scmi: Fix freeing of dynamic OPPs)
> 
> Signed-off-by: Yangtao Li <tiny.windzz@xxxxxxxxx>
> ---
>  drivers/cpufreq/scmi-cpufreq.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
> index 242c3370544e..9ed46d188cb5 100644
> --- a/drivers/cpufreq/scmi-cpufreq.c
> +++ b/drivers/cpufreq/scmi-cpufreq.c
> @@ -187,8 +187,8 @@ static int scmi_cpufreq_exit(struct cpufreq_policy *policy)
>  
>  	cpufreq_cooling_unregister(priv->cdev);
>  	dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table);
> -	kfree(priv);
>  	dev_pm_opp_remove_all_dynamic(priv->cpu_dev);
> +	kfree(priv);
>  
>  	return 0;
>  }

Acked-by: Viresh Kumar <viresh.kumar@xxxxxxxxxx>

@Rafael: Please pick it up for 5.0-rc8 as the bug was introduced
during 5.0 cycle only.

The patch it fixes had this tag:

    Cc: 4.20 <stable@xxxxxxxxxxxxxxx> # v4.20

And so will get applied to 4.20.N, I guess we need to mark this patch
as well for stable then.

-- 
viresh