TPM: Avoid reference to potentially freed memory

Reference to the 'np' node is dropped before dereferencing the 'sizep' and
'basep' pointers, which could by then point to junk if the node has been
freed.

Refactor code to call 'of_node_put' later.

Fixes: c5df39262dd5 ("drivers/char/tpm: Add securityfs support for event log")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Acked-by: Peter Huewe <PeterHuewe@gmx.de>

diff --git a/drivers/char/tpm/tpm_of.c b/drivers/char/tpm/tpm_of.c
index 1141456a4b1f1b974192e89574af9e165051922b..570f30c5c5f42ee5ee8076e17f45301de11ecf59 100644 (file)
--- a/drivers/char/tpm/tpm_of.c
+++ b/drivers/char/tpm/tpm_of.c
@@ -53,17 +53,18 @@ int read_log(struct tpm_bios_log *log)
                goto cleanup_eio;
        }
 
-       of_node_put(np);
        log->bios_event_log = kmalloc(*sizep, GFP_KERNEL);
        if (!log->bios_event_log) {
                pr_err("%s: ERROR - Not enough memory for BIOS measurements\n",
                       __func__);
+               of_node_put(np);
                return -ENOMEM;
        }
 
        log->bios_event_log_end = log->bios_event_log + *sizep;
 
        memcpy(log->bios_event_log, __va(*basep), *sizep);
+       of_node_put(np);
 
        return 0;