Catcrafts/milos-linux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

nvmem: core: fix use-after-free bugs in error paths

Browse source 
Fix several instances of error paths in which we call
__nvmem_device_put() - which may end up freeing the underlying memory
and other resources - and then keep on using the nvmem structure. Always
put the reference to the nvmem device as the last step before returning
the error code.

Cc: stable@vger.kernel.org
Fixes: 7ae6478b30 ("nvmem: core: rework nvmem cell instance creation")
Fixes: e888d445ac ("nvmem: resolve cells from DT at registration time")
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260530204340.116743-3-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Bartosz Golaszewski 2026-05-30 21:43:40 +01:00 • committed by Greg Kroah-Hartman
commit 5b6b6fc491
1 changed files with 5 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

12
drivers/nvmem/core.c
View file

@ -1468,18 +1468,16 @@ struct nvmem_cell *of_nvmem_cell_get(struct device_node *np, const char *id)
cell_entry = nvmem_find_cell_entry_by_node(nvmem, cell_np);
of_node_put(cell_np);
if (!cell_entry) {
__nvmem_device_put(nvmem);
nvmem_layout_module_put(nvmem);
if (nvmem->layout)
return ERR_PTR(-EPROBE_DEFER);
else
return ERR_PTR(-ENOENT);
ret = nvmem->layout ? -EPROBE_DEFER : -ENOENT;
__nvmem_device_put(nvmem);
return ERR_PTR(ret);
}
cell = nvmem_create_cell(cell_entry, id, cell_index);
if (IS_ERR(cell)) {
__nvmem_device_put(nvmem);
nvmem_layout_module_put(nvmem);
__nvmem_device_put(nvmem);
}
return cell;
@ -1593,8 +1591,8 @@ void nvmem_cell_put(struct nvmem_cell *cell)
kfree_const(cell->id);
kfree(cell);
__nvmem_device_put(nvmem);
nvmem_layout_module_put(nvmem);
__nvmem_device_put(nvmem);
}
EXPORT_SYMBOL_GPL(nvmem_cell_put);