regulator: core: fix regulator_register() error paths to properly release rdev
[ Upstream commita3cde9534e
] There are several issues with the error handling code of the regulator_register() function: ret = device_register(&rdev->dev); if (ret != 0) { put_device(&rdev->dev); --> rdev released goto unset_supplies; } ... unset_supplies: ... unset_regulator_supplies(rdev); --> use-after-free ... clean: if (dangling_of_gpiod) gpiod_put(config->ena_gpiod); kfree(rdev); --> double free We add a variable to record the failure of device_register() and move put_device() down a bit to avoid the above issues. Fixes:c438b9d017
("regulator: core: Move registration of regulator device") Signed-off-by: Wen Yang <wenyang@linux.alibaba.com> Cc: Liam Girdwood <lgirdwood@gmail.com> Cc: Mark Brown <broonie@kernel.org> Cc: linux-kernel@vger.kernel.org Link: https://lore.kernel.org/r/20191201030250.38074-1-wenyang@linux.alibaba.com Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
0fb18176a6
commit
91a0261630
|
@ -4992,6 +4992,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
|
|||
struct regulator_dev *rdev;
|
||||
bool dangling_cfg_gpiod = false;
|
||||
bool dangling_of_gpiod = false;
|
||||
bool reg_device_fail = false;
|
||||
struct device *dev;
|
||||
int ret, i;
|
||||
|
||||
|
@ -5177,7 +5178,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
|
|||
dev_set_drvdata(&rdev->dev, rdev);
|
||||
ret = device_register(&rdev->dev);
|
||||
if (ret != 0) {
|
||||
put_device(&rdev->dev);
|
||||
reg_device_fail = true;
|
||||
goto unset_supplies;
|
||||
}
|
||||
|
||||
|
@ -5208,7 +5209,10 @@ wash:
|
|||
clean:
|
||||
if (dangling_of_gpiod)
|
||||
gpiod_put(config->ena_gpiod);
|
||||
kfree(rdev);
|
||||
if (reg_device_fail)
|
||||
put_device(&rdev->dev);
|
||||
else
|
||||
kfree(rdev);
|
||||
kfree(config);
|
||||
rinse:
|
||||
if (dangling_cfg_gpiod)
|
||||
|
|
Loading…
Reference in New Issue