* [PATCH 0/1] drivers/mcb update for 5.16
@ 2021-09-06 12:35 Johannes Thumshirn
2021-09-06 12:35 ` [PATCH 1/1] mcb: fix error handling in mcb_alloc_bus() Johannes Thumshirn
0 siblings, 1 reply; 2+ messages in thread
From: Johannes Thumshirn @ 2021-09-06 12:35 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Johannes Thumshirn, linux-kernel, Dan Carpenter, Johannes Thumshirn
Hi Greg,
Here's a patch from Dan for mcb that was originally intented to go into 5.14.
Back then you've asked me to tag it for stable and resend, which I forgot to
do.
As this driver has only very small user base I think queueing it for 5.16 is
ok, but if you can get it into 5.15 it'll be even better.
Thansk a lot and sorry for forgetting it Dan.
Byte,
Johannes
Dan Carpenter (1):
mcb: fix error handling in mcb_alloc_bus()
drivers/mcb/mcb-core.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--
2.32.0
^ permalink raw reply [flat|nested] 2+ messages in thread
* [PATCH 1/1] mcb: fix error handling in mcb_alloc_bus()
2021-09-06 12:35 [PATCH 0/1] drivers/mcb update for 5.16 Johannes Thumshirn
@ 2021-09-06 12:35 ` Johannes Thumshirn
0 siblings, 0 replies; 2+ messages in thread
From: Johannes Thumshirn @ 2021-09-06 12:35 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Johannes Thumshirn, linux-kernel, Dan Carpenter, stable
From: Dan Carpenter <dan.carpenter@oracle.com>
There are two bugs:
1) If ida_simple_get() fails then this code calls put_device(carrier)
but we haven't yet called get_device(carrier) and probably that
leads to a use after free.
2) After device_initialize() then we need to use put_device() to
release the bus. This will free the internal resources tied to the
device and call mcb_free_bus() which will free the rest.
Fixes: 5d9e2ab9fea4 ("mcb: Implement bus->dev.release callback")
Fixes: 18d288198099 ("mcb: Correctly initialize the bus's device")
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Johannes Thumshirn <jth@kernel.org>
---
drivers/mcb/mcb-core.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/mcb/mcb-core.c b/drivers/mcb/mcb-core.c
index edf4ee6eff25..cf128b3471d7 100644
--- a/drivers/mcb/mcb-core.c
+++ b/drivers/mcb/mcb-core.c
@@ -275,8 +275,8 @@ struct mcb_bus *mcb_alloc_bus(struct device *carrier)
bus_nr = ida_simple_get(&mcb_ida, 0, 0, GFP_KERNEL);
if (bus_nr < 0) {
- rc = bus_nr;
- goto err_free;
+ kfree(bus);
+ return ERR_PTR(bus_nr);
}
bus->bus_nr = bus_nr;
@@ -291,12 +291,12 @@ struct mcb_bus *mcb_alloc_bus(struct device *carrier)
dev_set_name(&bus->dev, "mcb:%d", bus_nr);
rc = device_add(&bus->dev);
if (rc)
- goto err_free;
+ goto err_put;
return bus;
-err_free:
- put_device(carrier);
- kfree(bus);
+
+err_put:
+ put_device(&bus->dev);
return ERR_PTR(rc);
}
EXPORT_SYMBOL_NS_GPL(mcb_alloc_bus, MCB);
--
2.32.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-09-06 12:36 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-06 12:35 [PATCH 0/1] drivers/mcb update for 5.16 Johannes Thumshirn
2021-09-06 12:35 ` [PATCH 1/1] mcb: fix error handling in mcb_alloc_bus() Johannes Thumshirn
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).