This Linux kernel change "crypto: crypto4xx – fix a potential double free in ppc4xx_trng_probe" is included in the Linux 4.9.187 release. This change is authored by Wen Yang <wen.yang99 [at] zte.com.cn> on Mon Jul 8 14:19:03 2019 +0800. The commit for this change in Linux stable tree is c9a9f1b (patch) which is from upstream commit 95566aa. The same Linux upstream change may have been applied to various maintained Linux releases and you can find all Linux releases containing changes from upstream 95566aa.
crypto: crypto4xx - fix a potential double free in ppc4xx_trng_probe commit 95566aa75cd6b3b404502c06f66956b5481194b3 upstream. There is a possible double free issue in ppc4xx_trng_probe(): 85: dev->trng_base = of_iomap(trng, 0); 86: of_node_put(trng); ---> released here 87: if (!dev->trng_base) 88: goto err_out; ... 110: ierr_out: 111: of_node_put(trng); ---> double released here ... This issue was detected by using the Coccinelle software. We fix it by removing the unnecessary of_node_put(). Fixes: 5343e674f32f ("crypto4xx: integrate ppc4xx-rng into crypto4xx") Signed-off-by: Wen Yang <[email protected]> Cc: <[email protected]> Cc: "David S. Miller" <[email protected]> Cc: Thomas Gleixner <[email protected]> Cc: Greg Kroah-Hartman <[email protected]> Cc: Allison Randal <[email protected]> Cc: Armijn Hemel <[email protected]> Cc: Julia Lawall <[email protected]> Cc: [email protected] Cc: [email protected] Acked-by: Julia Lawall <[email protected]> Signed-off-by: Herbert Xu <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
There is one line of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.
drivers/crypto/amcc/crypto4xx_trng.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/crypto/amcc/crypto4xx_trng.c b/drivers/crypto/amcc/crypto4xx_trng.c index 368c559..a194ee0 100644 --- a/drivers/crypto/amcc/crypto4xx_trng.c +++ b/drivers/crypto/amcc/crypto4xx_trng.c @@ -111,7 +111,6 @@ void ppc4xx_trng_probe(struct crypto4xx_core_device *core_dev) return; err_out: - of_node_put(trng); iounmap(dev->trng_base); kfree(rng); dev->trng_base = NULL;