OSDN Git Service

driver: uio: fix possible use-after-free in __uio_register_device
authorLiu Jian <liujian56@huawei.com>
Tue, 22 Jan 2019 22:45:38 +0000 (06:45 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 27 Jan 2020 13:50:17 +0000 (14:50 +0100)
commit3b3f78a629a4df86f7db72268c2636f3135f0cdc
tree965b704c8ee06aa803d5f534a42496a8b41318df
parent3b656e7c166d14d8cb6acecd26e5761274ba2b73
driver: uio: fix possible use-after-free in __uio_register_device

[ Upstream commit 221a1f4ac12d2ab46246c160b2e00d1b1160d5d9 ]

In uio_dev_add_attributes() error handing case, idev is used after
device_unregister(), in which 'idev' has been released, touch idev cause
use-after-free.

Fixes: a93e7b331568 ("uio: Prevent device destruction while fds are open")
Signed-off-by: Liu Jian <liujian56@huawei.com>
Reviewed-by: Hamish Martin <hamish.martin@alliedtelesis.co.nz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/uio/uio.c