Messages in this thread Patch in this message | | | Date | Sat, 15 Jan 2022 02:12:07 +0100 | From | Michał Mirosław <> | Subject | [PATCH] i2c: core: fix potential use-after-free on adapter removal |
| |
put_device(&adap->dev) might free the memory pointed to by `adap`, so we shouldn't read adap->owner after that.
Fix by saving module pointer before calling put_device().
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl> --- drivers/i2c/i2c-core-base.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index 2c59dd748a49..5d694f8ce9ef 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -2464,11 +2464,14 @@ EXPORT_SYMBOL(i2c_get_adapter); void i2c_put_adapter(struct i2c_adapter *adap) { + struct module *owner; + if (!adap) return; + owner = adap->owner; put_device(&adap->dev); - module_put(adap->owner); + module_put(owner); } EXPORT_SYMBOL(i2c_put_adapter); -- 2.30.2
| |