commit 31d4c528cea4023cf36f6148c03bb960cedefeef
author Vincent Stehlé <vincent.stehle@laposte.net> Wed Mar 27 23:06:42 2019 +0100
committer Rafael J. Wysocki <rafael.j.wysocki@intel.com> Thu Mar 28 11:14:31 2019 +0100
tree ca53c6dc0b23b2fc4f9b419575af92bf83248999
parent 92a3e426ec06e72b1c363179c79d30712447ff76

cpufreq: scpi: Fix use after free

Free the priv structure only after we are done using it.

Fixes: 1690d8bb91e370ab ("cpufreq: scpi/scmi: Fix freeing of dynamic OPPs")
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Cc: 4.20+ <stable@vger.kernel.org> # 4.20+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

drivers/cpufreq/scpi-cpufreq.c

diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c
index 3f49427..2b51e07 100644
--- a/drivers/cpufreq/scpi-cpufreq.c
+++ b/drivers/cpufreq/scpi-cpufreq.c
@@ -189,8 +189,8 @@ static int scpi_cpufreq_exit(struct cpufreq_policy *policy)
 
 	clk_put(priv->clk);
 	dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table);
-	kfree(priv);
 	dev_pm_opp_remove_all_dynamic(priv->cpu_dev);
+	kfree(priv);
 
 	return 0;
 }