| Message ID | 20160528050146.GC4107@mwanda |
|---|---|
| State | Accepted |
| Headers | show |
On Sat, May 28, 2016 at 08:01:46AM +0300, Dan Carpenter wrote: > The call to return_i2c_dev() frees "i2c_dev" so there is a use after > free when we call cdev_del(&i2c_dev->cdev). > > Fixes: d6760b14d4a1 ('i2c: dev: switch from register_chrdev to cdev API') > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Thanks! I'll revert the offending commit nonetheless because I still want to understand first why it slipped through my test system. And then we will try again with a better patch. > > diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c > index 2562a45..3bf4f0d 100644 > --- a/drivers/i2c/i2c-dev.c > +++ b/drivers/i2c/i2c-dev.c > @@ -592,9 +592,9 @@ static int i2cdev_detach_adapter(struct device *dev, void *dummy) > if (!i2c_dev) /* attach_adapter must have failed */ > return 0; > > + cdev_del(&i2c_dev->cdev); > return_i2c_dev(i2c_dev); > device_destroy(i2c_dev_class, MKDEV(I2C_MAJOR, adap->nr)); > - cdev_del(&i2c_dev->cdev); > > pr_debug("i2c-dev: adapter [%s] unregistered\n", adap->name); > return 0;
diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c index 2562a45..3bf4f0d 100644 --- a/drivers/i2c/i2c-dev.c +++ b/drivers/i2c/i2c-dev.c @@ -592,9 +592,9 @@ static int i2cdev_detach_adapter(struct device *dev, void *dummy) if (!i2c_dev) /* attach_adapter must have failed */ return 0; + cdev_del(&i2c_dev->cdev); return_i2c_dev(i2c_dev); device_destroy(i2c_dev_class, MKDEV(I2C_MAJOR, adap->nr)); - cdev_del(&i2c_dev->cdev); pr_debug("i2c-dev: adapter [%s] unregistered\n", adap->name); return 0;
The call to return_i2c_dev() frees "i2c_dev" so there is a use after free when we call cdev_del(&i2c_dev->cdev). Fixes: d6760b14d4a1 ('i2c: dev: switch from register_chrdev to cdev API') Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> -- To unsubscribe from this list: send the line "unsubscribe linux-i2c" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html