firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails
authorSudeep Holla <sudeep.holla@arm.com>
Fri, 1 Jul 2022 16:03:10 +0000 (17:03 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 17 Aug 2022 12:24:20 +0000 (14:24 +0200)
commit0c29e149b6bb498778ed8a1c9597b51acfba7856
treed06f9235a9820884c6f304cb936be9a5fa83b0c3
parentb574d1e3e9a2432b5acd9c4a9dc8d70b6a37aaf1
firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails

[ Upstream commit 689640efc0a2c4e07e6f88affe6d42cd40cc3f85 ]

When scpi probe fails, at any point, we need to ensure that the scpi_info
is not set and will remain NULL until the probe succeeds. If it is not
taken care, then it could result use-after-free as the value is exported
via get_scpi_ops() and could refer to a memory allocated via devm_kzalloc()
but freed when the probe fails.

Link: https://lore.kernel.org/r/20220701160310.148344-1-sudeep.holla@arm.com
Cc: stable@vger.kernel.org # 4.19+
Reported-by: huhai <huhai@kylinos.cn>
Reviewed-by: Jackie Liu <liuyun01@kylinos.cn>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/firmware/arm_scpi.c