cpufreq: scpi: Fix use after free

vstehle · rafaeljw · commit 31d4c528cea4 · 2019-03-28T11:14:31.000+01:00
Free the priv structure only after we are done using it. Fixes: 1690d8b ("cpufreq: scpi/scmi: Fix freeing of dynamic OPPs") Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net> Cc: 4.20+ <stable@vger.kernel.org> # 4.20+ Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c
@@ -189,8 +189,8 @@ static int scpi_cpufreq_exit(struct cpufreq_policy *policy)
 
 	clk_put(priv->clk);
 	dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table);
-	kfree(priv);
 	dev_pm_opp_remove_all_dynamic(priv->cpu_dev);
+	kfree(priv);
 
 	return 0;
 }

Original file line number	Diff line number	Diff line change
`@@ -189,8 +189,8 @@ static int scpi_cpufreq_exit(struct cpufreq_policy *policy)`
`189`	`189`
`190`	`190`	`clk_put(priv->clk);`
`191`	`191`	`dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table);`
`192`		`- kfree(priv);`
`193`	`192`	`dev_pm_opp_remove_all_dynamic(priv->cpu_dev);`
	`193`	`+ kfree(priv);`
`194`	`194`
`195`	`195`	`return 0;`
`196`	`196`	`}`