github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 10:09:10 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()

Browse Source 
If devm_platform_get_and_ioremap_resource() returns an error,
mlxbf_i2c_init_resource() frees tmp_res before reading tmp_res->io to
get the error code. This results in a use-after-free.

Save the error code before freeing tmp_res.

Fixes: b5b5b32081 ("i2c: mlxbf: I2C SMBus driver for Mellanox BlueField SoC")
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Cc: <stable@vger.kernel.org> # v5.10+
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260714150808.85045-1-xuanqiang.luo@linux.dev
This commit is contained in:
Xuanqiang Luo 2026-07-14 23:08:08 +08:00 committed by Andi Shyti
parent 9db20d23aa
commit 71356737a7
No known key found for this signature in database
GPG Key ID: DA78056626D32D6E
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/i2c/busses/i2c-mlxbf.c
View File

@ -1051,8 +1051,10 @@ static int mlxbf_i2c_init_resource(struct platform_device *pdev,
tmp_res->io = devm_platform_get_and_ioremap_resource(pdev, type, &tmp_res->params);
if (IS_ERR(tmp_res->io)) {
int ret = PTR_ERR(tmp_res->io);
devm_kfree(dev, tmp_res);
return PTR_ERR(tmp_res->io);
return ret;
}
tmp_res->type = type;