]> git.baikalelectronics.ru Git - kernel.git/commit
mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq()
authorDan Carpenter <dan.carpenter@oracle.com>
Fri, 29 Jan 2021 14:37:24 +0000 (17:37 +0300)
committerLee Jones <lee.jones@linaro.org>
Mon, 8 Feb 2021 13:54:40 +0000 (13:54 +0000)
commit1ed4d5ea9ef01272e0582e1c29cbc44790543d9a
tree62c46c1bde92a726a3a852ed54b07cc0dede7e3d
parent2001e7a345e361229cf8fdecf77e3f1bc1df31af
mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq()

The "req" struct is always added to the "wm831x->auxadc_pending" list,
but it's only removed from the list on the success path.  If a failure
occurs then the "req" struct is freed but it's still on the list,
leading to a use after free.

Fixes: 415688c4cfae ("mfd: Support multiple active WM831x AUXADC conversions")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
drivers/mfd/wm831x-auxadc.c