summaryrefslogtreecommitdiffstats
path: root/Documentation/devicetree/bindings/reset
diff options
context:
space:
mode:
authorGeert Uytterhoeven <geert+renesas@glider.be>2018-10-08 13:14:35 +0200
committerPhilipp Zabel <p.zabel@pengutronix.de>2018-10-08 15:25:21 +0200
commitb790c8ea5593d6dc3580adfad8e117eeb56af874 (patch)
treed2d2fe620766a8caf5d26cdc934ef5b0ef14a3aa /Documentation/devicetree/bindings/reset
parenteea2926b0a390969828e49ea96c45a2b1f007030 (diff)
reset: Fix potential use-after-free in __of_reset_control_get()
Calling of_node_put() decreases the reference count of a device tree object, and may free some data. However, the of_phandle_args structure embedding it is passed to reset_controller_dev.of_xlate() after that, so it may still be accessed. Move the call to of_node_put() down to fix this. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> [p.zabel@pengutronix.de: moved of_node_put after mutex_unlock] Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Diffstat (limited to 'Documentation/devicetree/bindings/reset')
0 files changed, 0 insertions, 0 deletions
pgalloc.h23
1 files changed, 10 insertions, 13 deletions
diff --git a/arch/m68k/include/asm/motorola_pgalloc.h b/arch/m68k/include/asm/motorola_pgalloc.h
index ff9cc401ffd1..85af0c602e9f 100644
--- a/arch/m68k/include/asm/motorola_pgalloc.h
+++ b/arch/m68k/include/asm/motorola_pgalloc.h
@@ -5,6 +5,9 @@
#include <asm/tlb.h>
#include <asm/tlbflush.h>
+extern void mmu_page_ctor(void *page);
+extern void mmu_page_dtor(void *page);
+
extern pmd_t *get_pointer_table(void);
extern int free_pointer_table(pmd_t *);
@@ -13,25 +16,21 @@ static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm)
pte_t *pte;
pte = (pte_t *)__get_free_page(GFP_KERNEL|__GFP_ZERO);
- if (pte) {
- __flush_page_to_ram(pte);
- flush_tlb_kernel_page(pte);
- nocache_page(pte);
- }
+ if (pte)
+ mmu_page_ctor(pte);
return pte;
}
static inline void pte_free_kernel(struct mm_struct *mm, pte_t *pte)
{
- cache_page(pte);
+ mmu_page_dtor(pte);
free_page((unsigned long) pte);
}
static inline pgtable_t pte_alloc_one(struct mm_struct *mm)
{
struct page *page;
- pte_t *pte;
page = alloc_pages(GFP_KERNEL|__GFP_ZERO, 0);
if(!page)
@@ -41,18 +40,16 @@ static inline pgtable_t pte_alloc_one(struct mm_struct *mm)
return NULL;
}
- pte = kmap(page);
- __flush_page_to_ram(pte);
- flush_tlb_kernel_page(pte);
- nocache_page(pte);
+ mmu_page_ctor(kmap(page));
kunmap(page);
+
return page;
}
static inline void pte_free(struct mm_struct *mm, pgtable_t page)
{
pgtable_pte_page_dtor(page);
- cache_page(kmap(page));
+ mmu_page_dtor(kmap(page));
kunmap(page);
__free_page(page);
}
@@ -61,7 +58,7 @@ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t page,
unsigned long address)
{
pgtable_pte_page_dtor(page);
- cache_page(kmap(page));
+ mmu_page_dtor(kmap(page));
kunmap(page);
__free_page(page);
}