From b93dfbbac6769c2f129777d4cbfaa0f466297a77 Mon Sep 17 00:00:00 2001 From: Sascha Hauer Date: Wed, 11 Nov 2020 15:06:56 +0100 Subject: ARM: layerscape: ppa: Fix use after free In of_psci_do_fixup() we want to delete the one job-ring device node which is used by the PPA secure firmware. When we have deleted the node we may not continue the for_each_compatible_node_from() loop, because that would derefence the just deleted node. We only want to delete a single node, so we do not need to continue the loop once we've found the node, so we can fix the issue by breaking out of the loop. Signed-off-by: Sascha Hauer --- arch/arm/mach-layerscape/ppa.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm/mach-layerscape/ppa.c b/arch/arm/mach-layerscape/ppa.c index 53e73f6a58..d962fba751 100644 --- a/arch/arm/mach-layerscape/ppa.c +++ b/arch/arm/mach-layerscape/ppa.c @@ -43,6 +43,7 @@ static int of_psci_do_fixup(struct device_node *root, void *unused) continue; of_delete_node(np); + break; } return of_psci_fixup(root, psci_version); -- cgit v1.2.3