i2c: Fix a potential use after free

ISCAS-Vulab · wsakernel · commit e4c72c06c367 · 2022-06-16T21:39:40.000+02:00
Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free. Fixes: 611e12e ("i2c: core: manage i2c bus device refcount in i2c_[get|put]_adapter") Signed-off-by: Xu Wang <vulab@iscas.ac.cn> [wsa: added comment to the code, added Fixes tag] Signed-off-by: Wolfram Sang <wsa@kernel.org>
diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
@@ -2461,8 +2461,9 @@ void i2c_put_adapter(struct i2c_adapter *adap)
 	if (!adap)
 		return;
 
-	put_device(&adap->dev);
 	module_put(adap->owner);
+	/* Should be last, otherwise we risk use-after-free with 'adap' */
+	put_device(&adap->dev);
 }
 EXPORT_SYMBOL(i2c_put_adapter);
 

Original file line number	Diff line number	Diff line change
`@@ -2461,8 +2461,9 @@ void i2c_put_adapter(struct i2c_adapter *adap)`
`2461`	`2461`	`if (!adap)`
`2462`	`2462`	`return;`
`2463`	`2463`
`2464`		`- put_device(&adap->dev);`
`2465`	`2464`	`module_put(adap->owner);`
	`2465`	`+ /* Should be last, otherwise we risk use-after-free with 'adap' */`
	`2466`	`+ put_device(&adap->dev);`
`2466`	`2467`	`}`
`2467`	`2468`	`EXPORT_SYMBOL(i2c_put_adapter);`
`2468`	`2469`