diff options
author | Wen Yang <wenyang@linux.alibaba.com> | 2019-12-01 11:02:50 +0800 |
---|---|---|
committer | Mark Brown <broonie@kernel.org> | 2019-12-03 12:18:33 +0000 |
commit | a3cde9534ebdafe18a9bbab208df724c57e6c8e8 (patch) | |
tree | b92322507f578fa544c9430a6c02031e815e7a3f /drivers/regulator/core.c | |
parent | 4affd79a125ac91e6a53be843ea3960a8fc00cbb (diff) | |
download | linux-stable-a3cde9534ebdafe18a9bbab208df724c57e6c8e8.tar.gz linux-stable-a3cde9534ebdafe18a9bbab208df724c57e6c8e8.tar.bz2 linux-stable-a3cde9534ebdafe18a9bbab208df724c57e6c8e8.zip |
regulator: core: fix regulator_register() error paths to properly release rdev
There are several issues with the error handling code of
the regulator_register() function:
ret = device_register(&rdev->dev);
if (ret != 0) {
put_device(&rdev->dev); --> rdev released
goto unset_supplies;
}
...
unset_supplies:
...
unset_regulator_supplies(rdev); --> use-after-free
...
clean:
if (dangling_of_gpiod)
gpiod_put(config->ena_gpiod);
kfree(rdev); --> double free
We add a variable to record the failure of device_register() and
move put_device() down a bit to avoid the above issues.
Fixes: c438b9d01736 ("regulator: core: Move registration of regulator device")
Signed-off-by: Wen Yang <wenyang@linux.alibaba.com>
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: linux-kernel@vger.kernel.org
Link: https://lore.kernel.org/r/20191201030250.38074-1-wenyang@linux.alibaba.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'drivers/regulator/core.c')
-rw-r--r-- | drivers/regulator/core.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c index c80f3fd9532d..2c3a03cfd381 100644 --- a/drivers/regulator/core.c +++ b/drivers/regulator/core.c @@ -4998,6 +4998,7 @@ regulator_register(const struct regulator_desc *regulator_desc, struct regulator_dev *rdev; bool dangling_cfg_gpiod = false; bool dangling_of_gpiod = false; + bool reg_device_fail = false; struct device *dev; int ret, i; @@ -5183,7 +5184,7 @@ regulator_register(const struct regulator_desc *regulator_desc, dev_set_drvdata(&rdev->dev, rdev); ret = device_register(&rdev->dev); if (ret != 0) { - put_device(&rdev->dev); + reg_device_fail = true; goto unset_supplies; } @@ -5213,7 +5214,10 @@ wash: clean: if (dangling_of_gpiod) gpiod_put(config->ena_gpiod); - kfree(rdev); + if (reg_device_fail) + put_device(&rdev->dev); + else + kfree(rdev); kfree(config); rinse: if (dangling_cfg_gpiod) |