driver: uio: fix possible use-after-free in __uio_register_device
authorLiu Jian <liujian56@huawei.com>
Tue, 22 Jan 2019 22:45:38 +0000 (06:45 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 27 Jan 2020 13:46:15 +0000 (14:46 +0100)
commit548752cabfaaf3945f2da9d202e70015c2991e9a
tree53bc8ac2d1aba1c8ec7f0ac2f3a0aa99c03f7cf1
parent1b97b03ace9e5f2d84dba9e8e347e76cfda40dbf
driver: uio: fix possible use-after-free in __uio_register_device

[ Upstream commit 221a1f4ac12d2ab46246c160b2e00d1b1160d5d9 ]

In uio_dev_add_attributes() error handing case, idev is used after
device_unregister(), in which 'idev' has been released, touch idev cause
use-after-free.

Fixes: a93e7b331568 ("uio: Prevent device destruction while fds are open")
Signed-off-by: Liu Jian <liujian56@huawei.com>
Reviewed-by: Hamish Martin <hamish.martin@alliedtelesis.co.nz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/uio/uio.c