From 0f3b12bab74e13a2b8686a49c5b83099da61e032 Mon Sep 17 00:00:00 2001 From: Linkai Gong Date: Thu, 6 Aug 2026 15:03:58 +0800 Subject: [PATCH] misc: enclosure: fix UAF on device_register() failure After device_register() fails, the embedded struct device has already been initialized and must be released with put_device() so that enclosure_release() can drop the parent reference and free edev. The error path currently does put_device(parent) + kfree(edev), which skips the device lifetime rules and can free the object while the device core still owns a reference (use-after-free). Fixes: d569d5bb3fd9 ("[SCSI] enclosure: add support for enclosure services") Signed-off-by: Linkai Gong Link: https://patch.msgid.link/20260806070358.1599627-1-gonglinkai@kylinos.cn Signed-off-by: Greg Kroah-Hartman --- drivers/misc/enclosure.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/misc/enclosure.c b/drivers/misc/enclosure.c index de457378c501..bdbff5178ec7 100644 --- a/drivers/misc/enclosure.c +++ b/drivers/misc/enclosure.c @@ -148,8 +148,7 @@ enclosure_register(struct device *dev, const char *name, int components, return edev; err: - put_device(edev->edev.parent); - kfree(edev); + put_device(&edev->edev); return ERR_PTR(err); } EXPORT_SYMBOL_GPL(enclosure_register);