Commit a3cde953 authored by Wen Yang's avatar Wen Yang Committed by Mark Brown

regulator: core: fix regulator_register() error paths to properly release rdev

There are several issues with the error handling code of
the regulator_register() function:
        ret = device_register(&rdev->dev);
        if (ret != 0) {
                put_device(&rdev->dev); --> rdev released
                goto unset_supplies;
        }
...
unset_supplies:
...
        unset_regulator_supplies(rdev); --> use-after-free
...
clean:
        if (dangling_of_gpiod)
                gpiod_put(config->ena_gpiod);
        kfree(rdev);                     --> double free

We add a variable to record the failure of device_register() and
move put_device() down a bit to avoid the above issues.

Fixes: c438b9d0 ("regulator: core: Move registration of regulator device")
Signed-off-by: default avatarWen Yang <wenyang@linux.alibaba.com>
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: linux-kernel@vger.kernel.org
Link: https://lore.kernel.org/r/20191201030250.38074-1-wenyang@linux.alibaba.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
parent 4affd79a
...@@ -4998,6 +4998,7 @@ regulator_register(const struct regulator_desc *regulator_desc, ...@@ -4998,6 +4998,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
struct regulator_dev *rdev; struct regulator_dev *rdev;
bool dangling_cfg_gpiod = false; bool dangling_cfg_gpiod = false;
bool dangling_of_gpiod = false; bool dangling_of_gpiod = false;
bool reg_device_fail = false;
struct device *dev; struct device *dev;
int ret, i; int ret, i;
...@@ -5183,7 +5184,7 @@ regulator_register(const struct regulator_desc *regulator_desc, ...@@ -5183,7 +5184,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
dev_set_drvdata(&rdev->dev, rdev); dev_set_drvdata(&rdev->dev, rdev);
ret = device_register(&rdev->dev); ret = device_register(&rdev->dev);
if (ret != 0) { if (ret != 0) {
put_device(&rdev->dev); reg_device_fail = true;
goto unset_supplies; goto unset_supplies;
} }
...@@ -5213,6 +5214,9 @@ regulator_register(const struct regulator_desc *regulator_desc, ...@@ -5213,6 +5214,9 @@ regulator_register(const struct regulator_desc *regulator_desc,
clean: clean:
if (dangling_of_gpiod) if (dangling_of_gpiod)
gpiod_put(config->ena_gpiod); gpiod_put(config->ena_gpiod);
if (reg_device_fail)
put_device(&rdev->dev);
else
kfree(rdev); kfree(rdev);
kfree(config); kfree(config);
rinse: rinse:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment