[PATCH] misc: enclosure: fix UAF on device_register() failure
Linkai Gong <[email protected]>
| Newsgroups | org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
After device_register() fails, the embedded struct device has already been
initialized and must be released with put_device() so that
enclosure_release() can drop the parent reference and free edev.
The error path currently does put_device(parent) + kfree(edev), which
skips the device lifetime rules and can free the object while the device
core still owns a reference (use-after-free).
Fixes: d569d5bb3fd9 ("[SCSI] enclosure: add support for enclosure services")
Signed-off-by: Linkai Gong <[email protected]>
---
drivers/misc/enclosure.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/misc/enclosure.c b/drivers/misc/enclosure.c
index cf6382981777..7e3887b646ad 100644
--- a/drivers/misc/enclosure.c
+++ b/drivers/misc/enclosure.c
@@ -148,8 +148,7 @@ enclosure_register(struct device *dev, const char *name, int components,
return edev;
err:
- put_device(edev->edev.parent);
- kfree(edev);
+ put_device(&edev->edev);
return ERR_PTR(err);
}
EXPORT_SYMBOL_GPL(enclosure_register);
--
2.25.1