| Message ID | 20240923222034.9833-1-a.burakov@rosalinux.ru (mailing list archive) |
|---|---|
| State | Superseded, archived |
| Delegated to: | Hans de Goede |
| Headers | show |
| Series | platform/x86: android-platform: deref after free in x86_android_tablet_probe() fix | expand |
diff --git a/drivers/platform/x86/x86-android-tablets/core.c b/drivers/platform/x86/x86-android-tablets/core.c index 919ef4471229..dea6ba1fd839 100644 --- a/drivers/platform/x86/x86-android-tablets/core.c +++ b/drivers/platform/x86/x86-android-tablets/core.c @@ -390,8 +390,10 @@ static __init int x86_android_tablet_probe(struct platform_device *pdev) for (i = 0; i < pdev_count; i++) { pdevs[i] = platform_device_register_full(&dev_info->pdev_info[i]); if (IS_ERR(pdevs[i])) { + int ret = PTR_ERR(pdevs[i]); + x86_android_tablet_remove(pdev); - return PTR_ERR(pdevs[i]); + return ret; } }
Pointer '&pdevs[i]' is dereferenced in x86_android_tablet_probe() after the referenced memory was deallocated by calling function x86_android_tablet_remove(). Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 62a5f689a068 ("platform/x86: x86-android-tablets: Move core code into new core.c file") Signed-off-by: Aleksandr Burakov <a.burakov@rosalinux.ru> --- drivers/platform/x86/x86-android-tablets/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)