Received: by 10.223.185.116 with SMTP id b49csp1062348wrg; Fri, 23 Feb 2018 11:13:30 -0800 (PST) X-Google-Smtp-Source: AH8x224P2qZaMaqvjBVYfpRNex+txo/lthTxXEaxZkvQRn5p91qhF/QT/VRzgTqtE+Tn2qLZTN0p X-Received: by 2002:a17:902:6b4c:: with SMTP id g12-v6mr2572197plt.363.1519413210671; Fri, 23 Feb 2018 11:13:30 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519413210; cv=none; d=google.com; s=arc-20160816; b=U3liIxw3ajCm2I7BtNGHx8B3ceMdaT6kXcaNu0U+1P2jT9mvb5W4sV8f4xc87+l9p6 26c8/wiqTeyum0iohMMAOLIofbu/zFuEQy1NMTf6JXvReq1mS0/Kn48jjUBMTTjJ56Vw vSD+B5iR2ZiukPXZAQlR3Ymlf8cr96LKbYE5Y6Cz6b5qm1ZBwblH9sN8c/oYekA9Z0d0 RopPBoEP996ChjuqrKLVr/j62CoYOGgk3UHkgc7vxBV++Dyb3d8b4Z+gCScO/joAjLkA XgaxAr6VS5GkBZirxSBWYzywa1x+D7s0azFJhls70NKC9OxqxOATOxCwfiZcejN9VPTl jV4g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=5cAnjeoB+2wMCb6BR/KFhNHyj+8bruVzceLsgB5cZ4s=; b=JuuMhtCeIWY4gqRwSt+KxlN7i6BT9g0wqYEpKSD3GvFSbowBT+IXgK+W4DG3RHRNz3 VtpJEW87PS7M+g8+m7sOj6MFWHDDFtQ2kqxx1zp+llS4rQLOGCrElWvqdlaD+WNBGf+C EQ0TK8czrNReVQkfQtQPd+z1++33NKRO9pDeKXpNorx8eEhhN1ytQgl3I7AlKscccqWY TNt4xKWWQPns7ztuTdie1vZqdJMHrJDlZtxWFxEoNwgx8glUKoErd9I83OgFjzXyr3Fs t93V/9vJ1Irb59CW+ydAPyIjaEX/Er8mJ6AEACYMUVCNq1/ijinCBd3K7Ly08MRmaBpP moNQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id m123si1844239pgm.698.2018.02.23.11.13.16; Fri, 23 Feb 2018 11:13:30 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754521AbeBWTMi (ORCPT + 99 others); Fri, 23 Feb 2018 14:12:38 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:48590 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934552AbeBWS4S (ORCPT ); Fri, 23 Feb 2018 13:56:18 -0500 Received: from localhost (LFbn-1-12258-90.w90-92.abo.wanadoo.fr [90.92.71.90]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 23FBA12C8; Fri, 23 Feb 2018 18:56:17 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Geert Uytterhoeven , Bjorn Helgaas , Simon Horman , Lorenzo Pieralisi , Sasha Levin Subject: [PATCH 4.14 151/159] PCI: rcar: Fix use-after-free in probe error path Date: Fri, 23 Feb 2018 19:27:39 +0100 Message-Id: <20180223170801.222910037@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180223170743.086611315@linuxfoundation.org> References: <20180223170743.086611315@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Geert Uytterhoeven [ Upstream commit 0c31f1d7be1b5c4858b1d714dcefa25f41428cab ] If CONFIG_DEBUG_SLAB=y, and no PCIe card is inserted, the kernel crashes during probe on r8a7791/koelsch: rcar-pcie fe000000.pcie: PCIe link down Unable to handle kernel paging request at virtual address 6b6b6b6b (seeing this message requires earlycon and keep_bootcon). Indeed, pci_free_host_bridge() frees the PCI host bridge, including the embedded rcar_pcie object, so pci_free_resource_list() must not be called afterwards. To fix this, move the call to pci_free_resource_list() up, and update the label name accordingly. Fixes: ddd535f1ea3eb27e ("PCI: rcar: Fix memory leak when no PCIe card is inserted") Signed-off-by: Geert Uytterhoeven Signed-off-by: Bjorn Helgaas Acked-by: Simon Horman Acked-by: Lorenzo Pieralisi Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- drivers/pci/host/pcie-rcar.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/pci/host/pcie-rcar.c +++ b/drivers/pci/host/pcie-rcar.c @@ -1146,12 +1146,12 @@ static int rcar_pcie_probe(struct platfo err = rcar_pcie_get_resources(pcie); if (err < 0) { dev_err(dev, "failed to request resources: %d\n", err); - goto err_free_bridge; + goto err_free_resource_list; } err = rcar_pcie_parse_map_dma_ranges(pcie, dev->of_node); if (err) - goto err_free_bridge; + goto err_free_resource_list; pm_runtime_enable(dev); err = pm_runtime_get_sync(dev); @@ -1194,9 +1194,9 @@ err_pm_put: err_pm_disable: pm_runtime_disable(dev); -err_free_bridge: - pci_free_host_bridge(bridge); +err_free_resource_list: pci_free_resource_list(&pcie->resources); + pci_free_host_bridge(bridge); return err; }