Messages in this thread Patch in this message | | | From | "Jerome Marchand" <> | Subject | [PATCH] platform driver: fix use-after-free in platform_device_del() | Date | Mon, 25 Jul 2016 16:13:32 +0200 |
| |
In platform_device_del(), the device is still used after a call to device_del(). At this point there is no guarantee that the device is still there and there could be a use-after-free access. Move the call to device_remove_properties() before device_del() to fix that.
Signed-off-by: Jerome Marchand <jmarchan@redhat.com> --- drivers/base/platform.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/base/platform.c b/drivers/base/platform.c index 6482d47..f57fff3 100644 --- a/drivers/base/platform.c +++ b/drivers/base/platform.c @@ -434,6 +434,7 @@ void platform_device_del(struct platform_device *pdev) int i; if (pdev) { + device_remove_properties(&pdev->dev); device_del(&pdev->dev); if (pdev->id_auto) { @@ -446,8 +447,6 @@ void platform_device_del(struct platform_device *pdev) if (r->parent) release_resource(r); } - - device_remove_properties(&pdev->dev); } } EXPORT_SYMBOL_GPL(platform_device_del); -- 2.5.5
| |