diff mbox series

[4.4,22/65] i2c: dev: use after free in detach

Message ID	20200526183914.507467866@linuxfoundation.org
State	New
Headers	show Return-Path: <SRS0=+fRt=7I=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Dan Carpenter <dan.carpenter@oracle.com>, Wolfram Sang <wsa@the-dreams.de>, Ben Hutchings <ben.hutchings@codethink.co.uk>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 4.4 22/65] i2c: dev: use after free in detach Date: Tue, 26 May 2020 20:52:41 +0200 Message-Id: <20200526183914.507467866@linuxfoundation.org> In-Reply-To: <20200526183905.988782958@linuxfoundation.org> References: <20200526183905.988782958@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	None \| expand [4.4,02/65] padata: Remove unused but set variables [4.4,05/65] padata: ensure padata_do_serial() runs on the correct CPU [4.4,06/65] evm: Check also if tfm is an error pointer in init_desc() [4.4,07/65] fix multiplication overflow in copy_fdtable() [4.4,10/65] USB: core: Fix misleading driver bug report [4.4,15/65] media-devnode: add missing mutex lock in error handler [4.4,17/65] media-device: dynamically allocate struct media_devnode [4.4,18/65] media: fix use-after-free in cdev_put() when app exits after driver unbind [4.4,20/65] i2c: dev: switch from register_chrdev to cdev API [4.4,21/65] i2c: dev: dont start function name with return [4.4,22/65] i2c: dev: use after free in detach [4.4,24/65] i2c: dev: Fix the race between the release of i2c_dev and cdev [4.4,27/65] padata: Replace delayed timer with immediate workqueue in padata_reorder [4.4,29/65] padata: purge get_cpu and reorder_via_wq from padata_do_serial [4.4,30/65] ALSA: pcm: fix incorrect hw_base increase [4.4,32/65] platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer [4.4,33/65] libnvdimm/btt: Remove unnecessary code in btt_freelist_init [4.4,35/65] l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6 bind() [4.4,37/65] l2tp: take a reference on sessions used in genetlink handlers [4.4,43/65] L2TP:Adjust intf MTU, add underlay L3, L2 hdrs. [4.4,46/65] l2tp: define parameters of l2tp_session_get() as "const" [4.4,47/65] l2tp: define parameters of l2tp_tunnel_find*() as "const" [4.4,48/65] l2tp: initialise sessions refcount before making it reachable [4.4,50/65] l2tp: hold tunnel while processing genl delete command [4.4,53/65] l2tp: hold tunnel used while creating sessions with netlink [4.4,54/65] l2tp: prevent creation of sessions on terminated tunnels [4.4,55/65] l2tp: pass tunnel pointer to ->session_create() [4.4,58/65] l2tp: initialise l2tp_eth sessions before registering them [4.4,59/65] l2tp: protect sock pointer of struct pppol2tp_session with RCU [4.4,61/65] Revert "gfs2: Dont demote a glock until its revokes are written" [4.4,64/65] iio: sca3000: Remove an erroneous get_device()

Commit Message

Greg Kroah-Hartman May 26, 2020, 6:52 p.m. UTC

From: Dan Carpenter <dan.carpenter@oracle.com>

commit e6be18f6d62c1d3b331ae020b76a29c2ccf6b0bf upstream.

The call to put_i2c_dev() frees "i2c_dev" so there is a use after
free when we call cdev_del(&i2c_dev->cdev).

Fixes: d6760b14d4a1 ('i2c: dev: switch from register_chrdev to cdev API')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/i2c-dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff mbox series

Patch

diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
index 382c66d5a470..e5cd307ebfc9 100644
--- a/drivers/i2c/i2c-dev.c
+++ b/drivers/i2c/i2c-dev.c
@@ -599,9 +599,9 @@  static int i2cdev_detach_adapter(struct device *dev, void *dummy)
 	if (!i2c_dev) /* attach_adapter must have failed */
 		return 0;
 
+	cdev_del(&i2c_dev->cdev);
 	put_i2c_dev(i2c_dev);
 	device_destroy(i2c_dev_class, MKDEV(I2C_MAJOR, adap->nr));
-	cdev_del(&i2c_dev->cdev);
 
 	pr_debug("i2c-dev: adapter [%s] unregistered\n", adap->name);
 	return 0;