VisionFive2 Linux kernel

StarFive Tech Linux Kernel for VisionFive (JH7110) boards (mirror)

More than 9999 Commits   33 Branches   57 Tags
author: Dan Williams <dan.j.williams@intel.com> 2023-06-02 23:13:54 -0700 committer: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 2023-07-19 16:36:20 +0200 commit: 7310b84821f043dcf77d5e6aa0ad55dc1e10a11d parent: 3b4c15171c3ce9120c81f5564b9367d8d0f4219c
Commit Summary:
dax: Fix dax_mapping_release() use after free
Diffstat:
1 file changed, 4 insertions, 1 deletion
diff --git a/drivers/dax/bus.c b/drivers/dax/bus.c
index 227800053309..aee695f86b44 100644
--- a/drivers/dax/bus.c
+++ b/drivers/dax/bus.c
@@ -635,10 +635,12 @@ EXPORT_SYMBOL_GPL(alloc_dax_region);
 static void dax_mapping_release(struct device *dev)
 {
 	struct dax_mapping *mapping = to_dax_mapping(dev);
-	struct dev_dax *dev_dax = to_dev_dax(dev->parent);
+	struct device *parent = dev->parent;
+	struct dev_dax *dev_dax = to_dev_dax(parent);
 
 	ida_free(&dev_dax->ida, mapping->id);
 	kfree(mapping);
+	put_device(parent);
 }
 
 static void unregister_dax_mapping(void *data)
@@ -778,6 +780,7 @@ static int devm_register_dax_mapping(struct dev_dax *dev_dax, int range_id)
 	dev = &mapping->dev;
 	device_initialize(dev);
 	dev->parent = &dev_dax->dev;
+	get_device(dev->parent);
 	dev->type = &dax_mapping_type;
 	dev_set_name(dev, "mapping%d", mapping->id);
 	rc = device_add(dev);