cpufreq: scmi: Fix use-after-free in scmi_cpufreq_exit()

TinyWindzz · rafaeljw · commit 8cbd468bdeb5 · 2019-02-19T11:17:37.000+01:00
This issue was detected with the help of Coccinelle. So change the order of function calls to fix it. Fixes: 1690d8b (cpufreq: scpi/scmi: Fix freeing of dynamic OPPs) Signed-off-by: Yangtao Li <tiny.windzz@gmail.com> Acked-by: Viresh Kumar <viresh.kumar@linaro.org> Acked-by: Sudeep Holla <sudeep.holla@arm.com> Cc: 4.20+ <stable@vger.kernel.org> # 4.20+ Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
@@ -187,8 +187,8 @@ static int scmi_cpufreq_exit(struct cpufreq_policy *policy)
 
 	cpufreq_cooling_unregister(priv->cdev);
 	dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table);
-	kfree(priv);
 	dev_pm_opp_remove_all_dynamic(priv->cpu_dev);
+	kfree(priv);
 
 	return 0;
 }

Original file line number	Diff line number	Diff line change
`@@ -187,8 +187,8 @@ static int scmi_cpufreq_exit(struct cpufreq_policy *policy)`
`187`	`187`
`188`	`188`	`cpufreq_cooling_unregister(priv->cdev);`
`189`	`189`	`dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table);`
`190`		`- kfree(priv);`
`191`	`190`	`dev_pm_opp_remove_all_dynamic(priv->cpu_dev);`
	`191`	`+ kfree(priv);`
`192`	`192`
`193`	`193`	`return 0;`
`194`	`194`	`}`