platform/x86: ISST: fix use-after-free in tpmi_sst_dev_remove()

harshimogalapalli · jwrdegoede · commit a4edf675ba33 · 2024-05-27T11:25:33.000+02:00
In tpmi_sst_dev_remove(), tpmi_sst is dereferenced after being freed. Fix this by reordering the kfree() post the dereference. Fixes: 9d1d362 ("platform/x86: ISST: Support partitioned systems") Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> Reviewed-by: Hans de Goede <hdegoede@redhat.com> Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Link: https://lore.kernel.org/r/20240517144946.289615-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Hans de Goede <hdegoede@redhat.com>
diff --git a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
@@ -1610,8 +1610,8 @@ void tpmi_sst_dev_remove(struct auxiliary_device *auxdev)
 	tpmi_sst->partition_mask_current &= ~BIT(plat_info->partition);
 	/* Free the package instance when the all partitions are removed */
 	if (!tpmi_sst->partition_mask_current) {
-		kfree(tpmi_sst);
 		isst_common.sst_inst[tpmi_sst->package_id] = NULL;
+		kfree(tpmi_sst);
 	}
 	mutex_unlock(&isst_tpmi_dev_lock);
 }

Original file line number	Diff line number	Diff line change
`@@ -1610,8 +1610,8 @@ void tpmi_sst_dev_remove(struct auxiliary_device *auxdev)`
`1610`	`1610`	`tpmi_sst->partition_mask_current &= ~BIT(plat_info->partition);`
`1611`	`1611`	`/* Free the package instance when the all partitions are removed */`
`1612`	`1612`	`if (!tpmi_sst->partition_mask_current) {`
`1613`		`- kfree(tpmi_sst);`
`1614`	`1613`	`isst_common.sst_inst[tpmi_sst->package_id] = NULL;`
	`1614`	`+ kfree(tpmi_sst);`
`1615`	`1615`	`}`
`1616`	`1616`	`mutex_unlock(&isst_tpmi_dev_lock);`
`1617`	`1617`	`}`