From d1b230a5f9697d4dc226fd7c219225e672d13a6b Mon Sep 17 00:00:00 2001 From: Miaoqian Lin Date: Wed, 11 May 2022 20:07:37 +0800 Subject: [PATCH] rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge ANBZ: #23371 commit 9715809b9eeb85b3f9b083857a2f29a9e2351125 stable. commit 65382585f067d4256ba087934f30f85c9b6984de upstream. of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Fixes: 53e2822e56c7 ("rpmsg: Introduce Qualcomm SMD backend") Signed-off-by: Miaoqian Lin Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220511120737.57374-1-linmq006@gmail.com Signed-off-by: Sasha Levin Fixes: CVE-2022-50112 Signed-off-by: Xiao Long Signed-off-by: WORKER_1545803445583 --- drivers/rpmsg/qcom_smd.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c index a4db9f6100d2..0b1e853d8c91 100644 --- a/drivers/rpmsg/qcom_smd.c +++ b/drivers/rpmsg/qcom_smd.c @@ -1364,6 +1364,7 @@ static int qcom_smd_parse_edge(struct device *dev, } edge->ipc_regmap = syscon_node_to_regmap(syscon_np); + of_node_put(syscon_np); if (IS_ERR(edge->ipc_regmap)) { ret = PTR_ERR(edge->ipc_regmap); goto put_node; -- Gitee