* [PATCH] i2c: core: fix use after free in of_i2c_notify
@ 2019-11-08 8:36 Wen Yang
2019-11-15 21:02 ` Wolfram Sang
0 siblings, 1 reply; 2+ messages in thread
From: Wen Yang @ 2019-11-08 8:36 UTC (permalink / raw)
To: wsa; +Cc: zhiche.yy, xlpang, linux-i2c, linux-kernel, Wen Yang
We can't use "adap" after it has been freed.
Fixes: 5bf4fa7daea6 ("i2c: break out OF support into separate file")
Signed-off-by: Wen Yang <wenyang@linux.alibaba.com>
Cc: Wolfram Sang <wsa@the-dreams.de>
Cc: linux-i2c@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
---
drivers/i2c/i2c-core-of.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/i2c/i2c-core-of.c b/drivers/i2c/i2c-core-of.c
index 6f632d54..7eb4199 100644
--- a/drivers/i2c/i2c-core-of.c
+++ b/drivers/i2c/i2c-core-of.c
@@ -245,14 +245,14 @@ static int of_i2c_notify(struct notifier_block *nb, unsigned long action,
}
client = of_i2c_register_device(adap, rd->dn);
- put_device(&adap->dev);
-
if (IS_ERR(client)) {
dev_err(&adap->dev, "failed to create client for '%pOF'\n",
rd->dn);
+ put_device(&adap->dev);
of_node_clear_flag(rd->dn, OF_POPULATED);
return notifier_from_errno(PTR_ERR(client));
}
+ put_device(&adap->dev);
break;
case OF_RECONFIG_CHANGE_REMOVE:
/* already depopulated? */
--
1.8.3.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] i2c: core: fix use after free in of_i2c_notify
2019-11-08 8:36 [PATCH] i2c: core: fix use after free in of_i2c_notify Wen Yang
@ 2019-11-15 21:02 ` Wolfram Sang
0 siblings, 0 replies; 2+ messages in thread
From: Wolfram Sang @ 2019-11-15 21:02 UTC (permalink / raw)
To: Wen Yang; +Cc: zhiche.yy, xlpang, linux-i2c, linux-kernel
[-- Attachment #1: Type: text/plain, Size: 384 bytes --]
On Fri, Nov 08, 2019 at 04:36:48PM +0800, Wen Yang wrote:
> We can't use "adap" after it has been freed.
>
> Fixes: 5bf4fa7daea6 ("i2c: break out OF support into separate file")
> Signed-off-by: Wen Yang <wenyang@linux.alibaba.com>
> Cc: Wolfram Sang <wsa@the-dreams.de>
> Cc: linux-i2c@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
Applied to for-current, thanks!
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-11-15 21:02 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-11-08 8:36 [PATCH] i2c: core: fix use after free in of_i2c_notify Wen Yang
2019-11-15 21:02 ` Wolfram Sang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).