Skip to content

Commit b47bdf4

Browse files
committed
hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
jira VULN-33707 jira VULN-33706 cve CVE-2022-49011 commit-author Yang Yingliang <[email protected]> commit 7dec145 As comment of pci_get_domain_bus_and_slot() says, it returns a pci device with refcount increment, when finish using it, the caller must decrement the reference count by calling pci_dev_put(). So call it after using to avoid refcount leak. Fixes: 14513ee ("hwmon: (coretemp) Use PCI host bridge ID to identify CPU if necessary") Signed-off-by: Yang Yingliang <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Guenter Roeck <[email protected]> (cherry picked from commit 7dec145) Signed-off-by: Jonathan Maple <[email protected]>
1 parent 4908260 commit b47bdf4

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

drivers/hwmon/coretemp.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -256,10 +256,13 @@ static int adjust_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
256256
*/
257257
if (host_bridge && host_bridge->vendor == PCI_VENDOR_ID_INTEL) {
258258
for (i = 0; i < ARRAY_SIZE(tjmax_pci_table); i++) {
259-
if (host_bridge->device == tjmax_pci_table[i].device)
259+
if (host_bridge->device == tjmax_pci_table[i].device) {
260+
pci_dev_put(host_bridge);
260261
return tjmax_pci_table[i].tjmax;
262+
}
261263
}
262264
}
265+
pci_dev_put(host_bridge);
263266

264267
for (i = 0; i < ARRAY_SIZE(tjmax_table); i++) {
265268
if (strstr(c->x86_model_id, tjmax_table[i].id))

0 commit comments

Comments
 (0)