github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

misc: enclosure: fix UAF on device_register() failure

Browse Source 
After device_register() fails, the embedded struct device has already been
initialized and must be released with put_device() so that
enclosure_release() can drop the parent reference and free edev.

The error path currently does put_device(parent) + kfree(edev), which
skips the device lifetime rules and can free the object while the device
core still owns a reference (use-after-free).

Fixes: d569d5bb3f ("[SCSI] enclosure: add support for enclosure services")
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
Link: https://patch.msgid.link/20260806070358.1599627-1-gonglinkai@kylinos.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Linkai Gong 2026-08-06 15:03:58 +08:00 committed by Greg Kroah-Hartman
parent 6f80fd798b
commit 0f3b12bab7
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/misc/enclosure.c
View File

@ -148,8 +148,7 @@ enclosure_register(struct device *dev, const char *name, int components,
return edev;
err:
put_device(edev->edev.parent);
kfree(edev);
put_device(&edev->edev);
return ERR_PTR(err);
}
EXPORT_SYMBOL_GPL(enclosure_register);