[PATCH v3 1/2] cxl/region: Fix use-after-free in find_pos_and_ways() error path

The error path releases its reference to a switch decoder before
logging an error that includes the decoder name. If the released
reference is the last one, the decoder can be freed before the error
message accesses its name.

Drop the reference after the error is reported.

Fixes: d90acdf49e18 ("cxl/region: Add a dev_err() on missing target list entries")
Reviewed-by: Li Ming <[email protected]>
Reviewed-by: Jonathan Cameron <[email protected]>
Signed-off-by: Alison Schofield <[email protected]>
---

Changes in v3:
- Log dev_name(dev) instead of dev_name(&cxlsd->cxld.dev) (Jonathan)
- Remove double space in commit log (Jonathan)
Changes in v2:
- No changes in v2


 drivers/cxl/core/region.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
index 1e211542b6b6..6d902e1c4161 100644
--- a/drivers/cxl/core/region.c
+++ b/drivers/cxl/core/region.c
@@ -1938,14 +1938,13 @@ static int find_pos_and_ways(struct cxl_port *port, struct range *range,
 			break;
 		}
 	}
-	put_device(dev);
-
 	if (rc)
 		dev_err(port->uport_dev,
 			"failed to find %s:%s in target list of %s\n",
 			dev_name(&port->dev),
-			dev_name(port->parent_dport->dport_dev),
-			dev_name(&cxlsd->cxld.dev));
+			dev_name(port->parent_dport->dport_dev), dev_name(dev));
+
+	put_device(dev);
 
 	return rc;
 }

base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482
-- 
2.37.3