i2c: dev: use after free in detach
Subsystems (3)
PATCH 1/1 i2c: dev: use after free in detach
The call to return_i2c_dev() frees "i2c_dev" so there is a use after free when we call cdev_del(&i2c_dev->cdev).
Fixes d6760b14d4a1 ('i2c: dev: switch from register_chrdev to cdev API')
Signed-off-by Dan Carpenter <[email protected]>
drivers/i2c/i2c-dev.c +1 -1
@@ -592,9 +592,9 @@ static int i2cdev_detach_adapter(struct device *dev, void *dummy)if (!i2c_dev)/* attach_adapter must have failed */ return 0 ; +cdev_del (&i2c_dev->cdev);return_i2c_dev (i2c_dev);device_destroy (i2c_dev_class,MKDEV (I2C_MAJOR , adap->nr)); -cdev_del (&i2c_dev->cdev);pr_debug ("i2c-dev: adapter [%s] unregistered\n" , adap->name);return 0 ;
Quoted 5 lines · Dan Carpenter
The call to
return_i2c_dev()frees "i2c_dev" so there is a use after free when we callcdev_del(&i2c_dev->cdev).Fixes d6760b14d4a1 ('i2c: dev: switch from register_chrdev to cdev API')Signed-off-by Dan Carpenter <[email protected]>
Thanks! I'll revert the offending commit nonetheless because I still want to understand first why it slipped through my test system. And then we will try again with a better patch.
Quoted 16 lines
drivers/i2c/i2c-dev.c +1
-1@@ -592,9 +592,9 @@ static int i2cdev_detach_adapter(struct device *dev, void *dummy)if (!i2c_dev)/* attach_adapter must have failed */ return 0 ; +cdev_del (&i2c_dev->cdev);return_i2c_dev (i2c_dev);device_destroy (i2c_dev_class,MKDEV (I2C_MAJOR , adap->nr)); -cdev_del (&i2c_dev->cdev);pr_debug ("i2c-dev: adapter [%s] unregistered\n" , adap->name);return 0 ;