summaryrefslogtreecommitdiff
path: root/drivers/mfd
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2021-01-29 17:37:24 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2021-03-04 10:26:33 +0100
commit0c79abee609da83f68461835d0100c7129d8dc52 (patch)
tree72ec8a1a355da531bb6e647e24a81bc06782921e /drivers/mfd
parent046a8158982bc67a56ce2b6c1e8ef020d2d49c05 (diff)
mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq()
[ Upstream commit 26783d74cc6a440ee3ef9836a008a697981013d0 ] The "req" struct is always added to the "wm831x->auxadc_pending" list, but it's only removed from the list on the success path. If a failure occurs then the "req" struct is freed but it's still on the list, leading to a use after free. Fixes: 78bb3688ea18 ("mfd: Support multiple active WM831x AUXADC conversions") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com> Signed-off-by: Lee Jones <lee.jones@linaro.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/mfd')
-rw-r--r--drivers/mfd/wm831x-auxadc.c3
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/mfd/wm831x-auxadc.c b/drivers/mfd/wm831x-auxadc.c
index 8a7cc0f86958..65b98f3fbd92 100644
--- a/drivers/mfd/wm831x-auxadc.c
+++ b/drivers/mfd/wm831x-auxadc.c
@@ -93,11 +93,10 @@ static int wm831x_auxadc_read_irq(struct wm831x *wm831x,
wait_for_completion_timeout(&req->done, msecs_to_jiffies(500));
mutex_lock(&wm831x->auxadc_lock);
-
- list_del(&req->list);
ret = req->val;
out:
+ list_del(&req->list);
mutex_unlock(&wm831x->auxadc_lock);
kfree(req);