2022-10-13 09:57:57

by Manank Patel

Subject: [PATCH] drivers: watchdog: exar_wdt.c fix use after free

fix use after free by storing the result of PTR_ERR(n->pdev)
to a local variable before returning.

Signed-off-by: Manank Patel <[email protected]>
---
drivers/watchdog/exar_wdt.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/watchdog/exar_wdt.c b/drivers/watchdog/exar_wdt.c
index 35058d8b21bc..7c61ff343271 100644
--- a/drivers/watchdog/exar_wdt.c
+++ b/drivers/watchdog/exar_wdt.c
@@ -355,8 +355,10 @@ static int __init exar_wdt_register(struct wdt_priv *priv, const int idx)
&priv->wdt_res, 1,
priv, sizeof(*priv));
if (IS_ERR(n->pdev)) {
+ int err = PTR_ERR(n->pdev);
+
kfree(n);
- return PTR_ERR(n->pdev);
+ return err;
}

list_add_tail(&n->list, &pdev_list);
--
2.38.0

2022-10-13 14:57:15

by Guenter Roeck

Subject: Re: [PATCH] drivers: watchdog: exar_wdt.c fix use after free

On 10/13/22 02:54, Manank Patel wrote:
> fix use after free by storing the result of PTR_ERR(n->pdev)
> to a local variable before returning.
>
> Signed-off-by: Manank Patel <[email protected]>

Reviewed-by: Guenter Roeck <[email protected]>

> ---
> drivers/watchdog/exar_wdt.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/watchdog/exar_wdt.c b/drivers/watchdog/exar_wdt.c
> index 35058d8b21bc..7c61ff343271 100644
> --- a/drivers/watchdog/exar_wdt.c
> +++ b/drivers/watchdog/exar_wdt.c
> @@ -355,8 +355,10 @@ static int __init exar_wdt_register(struct wdt_priv *priv, const int idx)
> &priv->wdt_res, 1,
> priv, sizeof(*priv));
> if (IS_ERR(n->pdev)) {
> + int err = PTR_ERR(n->pdev);
> +
> kfree(n);
> - return PTR_ERR(n->pdev);
> + return err;
> }
>
> list_add_tail(&n->list, &pdev_list);