i2c: Fix a potential use after free

jira VULN-1497
cve CVE-2019-25162
commit-author Xu Wang <[email protected]>
commit e4c72c0
upstream-diff There was a merge conflict because the file
    drivers/i2c/i2c-core.c was renamed to drivers/i2c/i2c-core-base.c in
    91ed534 ("i2c: rename core source file to allow refactorization").

Free the adap structure only after we are done using it.
This patch just moves the put_device() down a bit to avoid the
use after free.

Fixes: 611e12e ("i2c: core: manage i2c bus device refcount in i2c_[get|put]_adapter")
	Signed-off-by: Xu Wang <[email protected]>
[wsa: added comment to the code, added Fixes tag]
	Signed-off-by: Wolfram Sang <[email protected]>
(cherry picked from commit e4c72c0)
	Signed-off-by: Pratham Patel <[email protected]>

Author: thefossguy-ciq

drivers/i2c/i2c-core.c

@@ -2775,8 +2775,9 @@ void i2c_put_adapter(struct i2c_adapter *adap)
 	if (!adap)
 		return;
 
-	put_device(&adap->dev);
 	module_put(adap->owner);
+	/* Should be last, otherwise we risk use-after-free with 'adap' */
+	put_device(&adap->dev);
 }
 EXPORT_SYMBOL(i2c_put_adapter);