From ca263d97a83cd6e2e646197e46396519ac57dcb6 Mon Sep 17 00:00:00 2001 From: Eli Billauer Date: Fri, 9 Oct 2026 09:45:52 +0200 Subject: [PATCH] char: xillybus: Remove duplicate error path code Remove dedicated code for the error path, which is both redundant and incorrect: It calls kref_put() before mutex_unlock(&chan->lock). As kref_put() may result in releasing the memory containing the mutex, this could lead to UAF. Assisted-by: Deepseek:v4-pro Kimi:K2.6 ChatGPT:GPT-5.5 Claude:Sonnet-4.6 Assisted-by: Sashiko-0.2.5:gemini-3.1-pro-preview Signed-off-by: Eli Billauer Link: https://patch.msgid.link/20261009074557.19996-3-eli.billauer@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/char/xillybus/xillyusb.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/drivers/char/xillybus/xillyusb.c b/drivers/char/xillybus/xillyusb.c index 13dda738477c..9de4298209e7 100644 --- a/drivers/char/xillybus/xillyusb.c +++ b/drivers/char/xillybus/xillyusb.c @@ -1413,15 +1413,11 @@ static int xillyusb_open(struct inode *inode, struct file *filp) if (filp->f_mode & FMODE_WRITE) chan->open_for_write = 0; - mutex_unlock(&chan->lock); - - kref_put(&xdev->kref, cleanup_dev); - - return rc; - unmutex_fail: - kref_put(&xdev->kref, cleanup_dev); mutex_unlock(&chan->lock); + + kref_put(&xdev->kref, cleanup_dev); + return rc; }