Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

firmware: xilinx: Fix dereferencing freed memory

Fix smatch warning:
drivers/firmware/xilinx/zynqmp.c:1288 zynqmp_firmware_remove()
error: dereferencing freed memory 'feature_data'

Use hash_for_each_safe for safe removal of hash entry.

Fixes: acfdd18591ea ("firmware: xilinx: Use hash-table for api feature check")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Tejas Patel <tejas.patel@xilinx.com>
Signed-off-by: Rajan Vaja <rajan.vaja@xilinx.com>
Link: https://lore.kernel.org/r/1612765883-22018-1-git-send-email-rajan.vaja@xilinx.com
Signed-off-by: Michal Simek <michal.simek@xilinx.com>

authored by

Tejas Patel and committed by
Michal Simek
f1f21bec fe07bfda

+3 -2
+3 -2
drivers/firmware/xilinx/zynqmp.c
··· 2 2 /* 3 3 * Xilinx Zynq MPSoC Firmware layer 4 4 * 5 - * Copyright (C) 2014-2020 Xilinx, Inc. 5 + * Copyright (C) 2014-2021 Xilinx, Inc. 6 6 * 7 7 * Michal Simek <michal.simek@xilinx.com> 8 8 * Davorin Mista <davorin.mista@aggios.com> ··· 1280 1280 static int zynqmp_firmware_remove(struct platform_device *pdev) 1281 1281 { 1282 1282 struct pm_api_feature_data *feature_data; 1283 + struct hlist_node *tmp; 1283 1284 int i; 1284 1285 1285 1286 mfd_remove_devices(&pdev->dev); 1286 1287 zynqmp_pm_api_debugfs_exit(); 1287 1288 1288 - hash_for_each(pm_api_features_map, i, feature_data, hentry) { 1289 + hash_for_each_safe(pm_api_features_map, i, tmp, feature_data, hentry) { 1289 1290 hash_del(&feature_data->hentry); 1290 1291 kfree(feature_data); 1291 1292 }