[PATCH] can: flexcan: fix an use-after-free in flexcan_setup_stop_mode()

[Wen Yang]

The gpr_np variable is still being used in dev_dbg() after the
of_node_put() call, which may result in use-after-free.

Fixes: de3578c198c6 ("can: flexcan: add self wakeup support")
Signed-off-by: Wen Yang <wen.yan...@zte.com.cn>
Cc: Wolfgang Grandegger <w...@grandegger.com>
Cc: Marc Kleine-Budde <m...@pengutronix.de>
Cc: "David S. Miller" <da...@davemloft.net>
Cc: linux-...@vger.kernel.org
Cc: net...@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
---
 drivers/net/can/flexcan.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index f2fe344..33ce45d 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -1437,10 +1437,10 @@ static int flexcan_setup_stop_mode(struct 
platform_device *pdev)
 
        priv = netdev_priv(dev);
        priv->stm.gpr = syscon_node_to_regmap(gpr_np);
-       of_node_put(gpr_np);
        if (IS_ERR(priv->stm.gpr)) {
                dev_dbg(&pdev->dev, "could not find gpr regmap\n");
-               return PTR_ERR(priv->stm.gpr);
+               ret = PTR_ERR(priv->stm.gpr);
+               goto out_put_node;
        }
 
        priv->stm.req_gpr = out_val[1];
@@ -1455,7 +1455,9 @@ static int flexcan_setup_stop_mode(struct platform_device 
*pdev)
 
        device_set_wakeup_capable(&pdev->dev, true);
 
-       return 0;
+out_put_node:
+       of_node_put(gpr_np);
+       return ret;
 }
 
 static const struct of_device_id flexcan_of_match[] = {
-- 
2.9.5