From: Miquel Sabaté Solà mikisabate@gmail.com

stable inclusion from stable-v6.6.55 commit 0f41f383b5a61a2bf6429a449ebba7fb08179d81 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRBD CVE: CVE-2024-50012

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...

--------------------------------

commit c0f02536fffbbec71aced36d52a765f8c4493dc2 upstream.

In the parse_perf_domain function, if the call to of_parse_phandle_with_args returns an error, then the reference to the CPU device node that was acquired at the start of the function would not be properly decremented.

Address this by declaring the variable with the __free(device_node) cleanup attribute.

Signed-off-by: Miquel Sabaté Solà mikisabate@gmail.com Acked-by: Viresh Kumar viresh.kumar@linaro.org Link: https://patch.msgid.link/20240917134246.584026-1-mikisabate@gmail.com Cc: All applicable stable@vger.kernel.org Signed-off-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Jinjie Ruan ruanjinjie@huawei.com --- include/linux/cpufreq.h | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h index 8baf025e0d6e..9e1fb9a5480b 100644 --- a/include/linux/cpufreq.h +++ b/include/linux/cpufreq.h @@ -1135,10 +1135,9 @@ static inline int parse_perf_domain(int cpu, const char *list_name, const char *cell_name, struct of_phandle_args *args) { - struct device_node *cpu_np; int ret;

- cpu_np = of_cpu_device_node_get(cpu); + struct device_node *cpu_np __free(device_node) = of_cpu_device_node_get(cpu); if (!cpu_np) return -ENODEV;

@@ -1146,9 +1145,6 @@ static inline int parse_perf_domain(int cpu, const char *list_name, args); if (ret < 0) return ret; - - of_node_put(cpu_np); - return 0; }