The call to put_i2c_dev() frees "i2c_dev" so there is a use after
free when we call cdev_del(&i2c_dev->cdev).
Fixes:
|
||
---|---|---|
.. | ||
algos | ||
busses | ||
muxes | ||
Kconfig | ||
Makefile | ||
i2c-boardinfo.c | ||
i2c-core.c | ||
i2c-core.h | ||
i2c-dev.c | ||
i2c-mux.c | ||
i2c-slave-eeprom.c | ||
i2c-smbus.c | ||
i2c-stub.c |