diff options
| author | Geert Uytterhoeven <geert+renesas@glider.be> | 2023-11-29 17:55:33 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-01-05 15:12:23 +0100 |
| commit | c48219fad182b0f7de71c5daf8e12b20cf91f523 (patch) | |
| tree | 0757ea872afd7237a96cf145d0ae3e5b947daf2d /drivers/reset | |
| parent | c999682ce8ded4d9acdf657a19f114a421aa805d (diff) | |
| download | linux-c48219fad182b0f7de71c5daf8e12b20cf91f523.tar.gz linux-c48219fad182b0f7de71c5daf8e12b20cf91f523.tar.bz2 linux-c48219fad182b0f7de71c5daf8e12b20cf91f523.zip | |
reset: Fix crash when freeing non-existent optional resets
[ Upstream commit 4a6756f56bcf8e64c87144a626ce53aea4899c0e ]
When obtaining one or more optional resets, non-existent resets are
stored as NULL pointers, and all related error and cleanup paths need to
take this into account.
Currently only reset_control_put() and reset_control_bulk_put()
get this right. All of __reset_control_bulk_get(),
of_reset_control_array_get(), and reset_control_array_put() lack the
proper checking, causing NULL pointer dereferences on failure or
release.
Fix this by moving the existing check from reset_control_bulk_put() to
__reset_control_put_internal(), so it applies to all callers.
The double check in reset_control_put() doesn't hurt.
Fixes: 17c82e206d2a3cd8 ("reset: Add APIs to manage array of resets")
Fixes: 48d71395896d54ee ("reset: Add reset_control_bulk API")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/2440edae7ca8534628cdbaf559ded288f2998178.1701276806.git.geert+renesas@glider.be
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/reset')
| -rw-r--r-- | drivers/reset/core.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/reset/core.c b/drivers/reset/core.c index f93388b9a4a1..662867435fbe 100644 --- a/drivers/reset/core.c +++ b/drivers/reset/core.c @@ -599,6 +599,9 @@ static void __reset_control_put_internal(struct reset_control *rstc) { lockdep_assert_held(&reset_list_mutex); + if (IS_ERR_OR_NULL(rstc)) + return; + kref_put(&rstc->refcnt, __reset_control_release); } |