From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 07944C48BE5 for ; Tue, 15 Jun 2021 15:42:02 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id DE9E56141F for ; Tue, 15 Jun 2021 15:42:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231659AbhFOPoD (ORCPT ); Tue, 15 Jun 2021 11:44:03 -0400 Received: from mail.kernel.org ([198.145.29.99]:43258 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231274AbhFOPoB (ORCPT ); Tue, 15 Jun 2021 11:44:01 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 46FE561002; Tue, 15 Jun 2021 15:41:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623771716; bh=yJTopbixleB7kemFb4eatmN34SwffsvKgGcIbjW8pJg=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=I8s6Uc8FjQLM826adqQpx0iX2PKuHcIdo5BUSHFpxE6N7UpHh/O0iW/NFuizSZCQZ yefzKMuMlcGlvNkVdgcd8ASHchTAPtZVMoYpyz6fR+x+r3ZpnXzMCbiLeZPaEWY3/a Mhy/EIlNHUuFd77RHBHadIkdURJqZMvNC8oR0g+Q= Date: Tue, 15 Jun 2021 17:41:54 +0200 From: Greg Kroah-Hartman To: Johannes Thumshirn Cc: linux-kernel@vger.kernel.org, Dan Carpenter , Johannes Thumshirn Subject: Re: [PATCH 2/3] mcb: fix error handling in mcb_alloc_bus() Message-ID: References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Jun 15, 2021 at 11:55:29PM +0900, Johannes Thumshirn wrote: > From: Dan Carpenter > > There are two bugs: > 1) If ida_simple_get() fails then this code calls put_device(carrier) > but we haven't yet called get_device(carrier) and probably that > leads to a use after free. > 2) After device_initialize() then we need to use put_device() to > release the bus. This will free the internal resources tied to the > device and call mcb_free_bus() which will free the rest. > > Fixes: 5d9e2ab9fea4 ("mcb: Implement bus->dev.release callback") > Fixes: 18d288198099 ("mcb: Correctly initialize the bus's device") > Signed-off-by: Dan Carpenter > Signed-off-by: Johannes Thumshirn > --- > drivers/mcb/mcb-core.c | 12 ++++++------ > 1 file changed, 6 insertions(+), 6 deletions(-) Shouldn't this go to the stable kernels? Why not cc: stable in the signed-off-by lines? thanks, greg k-h