projects / wrapfs-3.14.y.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 49661be) | patch
i2c: dev: use after free in detach
authorDan Carpenter <dan.carpenter@oracle.com>
Sat, 28 May 2016 05:01:46 +0000 (08:01 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 27 May 2020 14:40:26 +0000 (16:40 +0200)
commit466b5897239e1c8586b6bc1c0db6f10e102d213c
treeffc11c91c606fa53651289a3cdbeb0c6264f463dtree | snapshot
parent49661be5ab43f9aa161deb06edd0dea90849519ccommit | diff
i2c: dev: use after free in detach

commit e6be18f6d62c1d3b331ae020b76a29c2ccf6b0bf upstream.

The call to put_i2c_dev() frees "i2c_dev" so there is a use after
free when we call cdev_del(&i2c_dev->cdev).

Fixes: d6760b14d4a1 ('i2c: dev: switch from register_chrdev to cdev API')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/i2c/i2c-dev.c diff | blob | history
wrapfs-3.14.y