Commit 16cd787d authored by Johan Hovold's avatar Johan Hovold Committed by Greg Kroah-Hartman

greybus: endo: fix use-after-free in error path

Fix use-after-free in endo-registration error path by moving the
id-release to the device release function.
Signed-off-by: default avatarJohan Hovold <johan@hovoldconsulting.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
parent d517f274
...@@ -113,6 +113,7 @@ static void gb_endo_release(struct device *dev) ...@@ -113,6 +113,7 @@ static void gb_endo_release(struct device *dev)
{ {
struct gb_endo *endo = to_gb_endo(dev); struct gb_endo *endo = to_gb_endo(dev);
ida_simple_remove(&greybus_endo_id_map, endo->dev_id);
kfree(endo); kfree(endo);
} }
...@@ -462,7 +463,6 @@ static int gb_endo_register(struct greybus_host_device *hd, ...@@ -462,7 +463,6 @@ static int gb_endo_register(struct greybus_host_device *hd,
dev_err(hd->parent, "failed to add endo device of id 0x%04x\n", dev_err(hd->parent, "failed to add endo device of id 0x%04x\n",
endo->id); endo->id);
put_device(&endo->dev); put_device(&endo->dev);
ida_simple_remove(&greybus_endo_id_map, endo->dev_id);
} }
return retval; return retval;
...@@ -518,7 +518,6 @@ void gb_endo_remove(struct gb_endo *endo) ...@@ -518,7 +518,6 @@ void gb_endo_remove(struct gb_endo *endo)
/* remove all modules for this endo */ /* remove all modules for this endo */
gb_module_remove_all(endo); gb_module_remove_all(endo);
ida_simple_remove(&greybus_endo_id_map, endo->dev_id);
device_unregister(&endo->dev); device_unregister(&endo->dev);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment