[PATCH 3.13.y-ckt 86/86] TPM: Avoid reference to potentially freed memory

From	Kamal Mostafa <kamal@canonical.com>
Newsgroups	linux.kernel
Subject	[PATCH 3.13.y-ckt 86/86] TPM: Avoid reference to potentially freed memory
Date	2015-12-03 00:00 +0100
Message-ID	<qBoxt-50H-53@gated-at.bofh.it> (permalink)
References	<qBoxr-50H-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

3.13.11-ckt31 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

commit eb8ed1eb9a158c460d10205eaff71fd4ac67c160 upstream.

Reference to the 'np' node is dropped before dereferencing the 'sizep' and
'basep' pointers, which could by then point to junk if the node has been
freed.

Refactor code to call 'of_node_put' later.

Fixes: c5df39262dd5 ("drivers/char/tpm: Add securityfs support for event log")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Acked-by: Peter Huewe <PeterHuewe@gmx.de>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/char/tpm/tpm_of.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/char/tpm/tpm_of.c b/drivers/char/tpm/tpm_of.c
index 98ba2bd..565a0b3 100644
--- a/drivers/char/tpm/tpm_of.c
+++ b/drivers/char/tpm/tpm_of.c
@@ -53,17 +53,18 @@ int read_log(struct tpm_bios_log *log)
 		goto cleanup_eio;
 	}
 
-	of_node_put(np);
 	log->bios_event_log = kmalloc(*sizep, GFP_KERNEL);
 	if (!log->bios_event_log) {
 		pr_err("%s: ERROR - Not enough memory for BIOS measurements\n",
 		       __func__);
+		of_node_put(np);
 		return -ENOMEM;
 	}
 
 	log->bios_event_log_end = log->bios_event_log + *sizep;
 
 	memcpy(log->bios_event_log, __va(be64_to_cpup(basep)), *sizep);
+	of_node_put(np);
 
 	return 0;
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

[3.13.y-ckt stable] Linux 3.13.11-ckt31 stable review Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:00 +0100
  [PATCH 3.13.y-ckt 04/86] drm/radeon: add quirk for ASUS R7 370 Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:00 +0100
  [PATCH 3.13.y-ckt 54/86] ALSA: hda - Add Intel Lewisburg device IDs Audio Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:00 +0100
  [PATCH 3.13.y-ckt 84/86] drm: Fix return value of drm_framebuffer_init() Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:00 +0100
  [PATCH 3.13.y-ckt 74/86] mwifiex: fix mwifiex_rdeeprom_read() Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:00 +0100
  [PATCH 3.13.y-ckt 82/86] packet: fix match_fanout_group() Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:00 +0100
  [PATCH 3.13.y-ckt 61/86] perf: Fix inherited events vs. tracepoint filters Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:00 +0100
  [PATCH 3.13.y-ckt 76/86] devres: fix a for loop bounds check Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:00 +0100
  [PATCH 3.13.y-ckt 64/86] storvsc: Don't set the SRB_FLAGS_QUEUE_ACTION_ENABLE flag Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:00 +0100
  [PATCH 3.13.y-ckt 86/86] TPM: Avoid reference to potentially freed memory Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:00 +0100
  [PATCH 3.13.y-ckt 14/86] [3.13-stable only] fib_rules: Fix dump_rules() not to exit early Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:00 +0100
  [PATCH 3.13.y-ckt 71/86] FS-Cache: Handle a write to the page immediately beyond the EOF marker Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 47/86] xtensa: fixes for configs without loop option Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 55/86] firewire: ohci: fix JMicron JMB38x IT context discovery Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 79/86] perf trace: Fix documentation for -i Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 60/86] Btrfs: fix race leading to BUG_ON when running delalloc for nodatacow Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 73/86] wm831x_power: Use IRQF_ONESHOT to request threaded IRQs Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 69/86] FS-Cache: Increase reference of parent after registering, netfs success Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 59/86] Btrfs: fix race leading to incorrect item deletion when dropping extents Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 63/86] Btrfs: fix race when listing an inode's xattrs Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 65/86] KVM: x86: Defining missing x86 vectors Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 78/86] ipv6: fix tunnel error handling Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 56/86] proc: actually make proc_fd_permission() thread-friendly Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 66/86] KVM: x86: work around infinite loop in microcode when #AC is delivered Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 57/86] printk: prevent userland from spoofing kernel messages Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 68/86] drm/ast: Initialized data needed to map fbdev memory Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 70/86] FS-Cache: Don't override netfs's primary_index if registering failed Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 81/86] mac80211: fix driver RSSI event calculations Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 62/86] scsi_sysfs: Fix queue_ramp_up_period return code Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 80/86] bonding: fix panic on non-ARPHRD_ETHER enslave failure Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 72/86] binfmt_elf: Don't clobber passed executable's file header Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 58/86] x86/cpu: Call verify_cpu() after having entered long mode too Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:10 +0100
  [PATCH 3.13.y-ckt 50/86] recordmcount: Fix endianness handling bug for nop_mcount Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 46/86] crypto: algif_hash - Only export and import on sockets with data Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 49/86] mac80211: allow null chandef in tracing Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 34/86] Bluetooth: ath3k: Add support of AR3012 0cf3:817b device Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 40/86] MAINTAINERS: Add public mailing list for ARC Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 38/86] ALSA: hda/realtek - Dell XPS one ALC3260 speaker no sound after resume back Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 44/86] mtd: blkdevs: fix potential deadlock + lockdep warnings Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 12/86] net: avoid NULL deref in inet_ctl_sock_destroy() Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 39/86] ALSA: hda - Disable 64bit address for Creative HDA controllers Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 17/86] net: mvneta: Fix CPU_MAP registers initialisation Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 35/86] spi: atmel: Fix DMA-setup for transfers with more than 8 bits per word Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 43/86] can: Use correct type in sizeof() in nla_put() Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 45/86] Revert "dm mpath: fix stalls when handling invalid ioctls" Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 32/86] Bluetooth: hidp: fix device disconnect on idle timeout Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 41/86] megaraid_sas: Do not use PAGE_SIZE for max_sectors Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 36/86] staging: rtl8712: Add device ID for Sitecom WLA2100 Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 31/86] [media] media: vb2 dma-contig: Fully cache synchronise buffers in prepare and finish Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 42/86] arm64: Fix compat register mappings Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 18/86] mtd: mtdpart: fix add_mtd_partitions error path Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 37/86] ACPI: Use correct IRQ when uninstalling ACPI interrupt handler Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 48/86] megaraid_sas : SMAP restriction--do not access user memory from IOCTL code Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 11/86] qmi_wwan: fix entry for HP lt4112 LTE/HSPA+ Gobi 4G Module Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 53/86] ALSA: hda - Apply pin fixup for HP ProBook 6550b Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 51/86] KVM: Disable SMAP for guests in EPT realmode and EPT unpaging mode Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 52/86] KVM: VMX: fix SMEP and SMAP without EPT Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 13/86] net: fix a race in dst_release() Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:20 +0100
  [PATCH 3.13.y-ckt 06/86] irda: precedence bug in irlmp_seq_hb_idx() Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 08/86] RDS-TCP: Recover correctly from pskb_pull()/pksb_trim() failure in rds_tcp_data_recv Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 16/86] [media] v4l2-compat-ioctl32: fix alignment for ARM64 Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 33/86] Bluetooth: ath3k: Add new AR3012 0930:021c id Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 02/86] x86/setup: Fix low identity map for >= 2GB kernel range Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 20/86] ARM: 8426/1: dma-mapping: add missing range check in dma_mmap() Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 29/86] ext4, jbd2: ensure entering into panic after recording an error in superblock Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 25/86] iommu/vt-d: Fix error in detect ATS capability Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 05/86] drm/radeon: fix quirk for MSI R7 370 Armor 2X Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 22/86] spi: ti-qspi: Fix data corruption seen on r/w stress test Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 28/86] [PATCH] fix calculation of meta_bg descriptor backups Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 10/86] ipmr: fix possible race resulting from improper usage of IP_INC_STATS_BH() in preemptible context. Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 23/86] lockd: create NSM handles per net namespace Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 07/86] macvtap: unbreak receiving of gro skb with frag list Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 15/86] HID: core: Avoid uninitialized buffer access Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 01/86] x86/setup: Extend low identity map to cover whole kernel range Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 03/86] drm/radeon: add quirk for MSI R7 370 Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 09/86] stmmac: Correctly report PTP capabilities. Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 24/86] ARM: common: edma: Fix channel parameter for irq callbacks Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 21/86] ARM: 8427/1: dma-mapping: add support for offset parameter in dma_mmap() Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 26/86] iommu/vt-d: Fix ATSR handling for Root-Complex integrated endpoints Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 27/86] ext4: fix potential use after free in __ext4_journal_stop Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100
  [PATCH 3.13.y-ckt 30/86] vTPM: fix memory allocation flag for rtce buffer at kernel boot Kamal Mostafa <kamal@canonical.com> - 2015-12-03 00:30 +0100

csiph-web