regulator: core: fix regulator_register() error paths to properly release rdev
authorWen Yang <wenyang@linux.alibaba.com>
Sun, 1 Dec 2019 03:02:50 +0000 (11:02 +0800)
committerMark Brown <broonie@kernel.org>
Tue, 3 Dec 2019 12:18:33 +0000 (12:18 +0000)
commita3cde9534ebdafe18a9bbab208df724c57e6c8e8
treeb92322507f578fa544c9430a6c02031e815e7a3f
parent4affd79a125ac91e6a53be843ea3960a8fc00cbb
regulator: core: fix regulator_register() error paths to properly release rdev

There are several issues with the error handling code of
the regulator_register() function:
        ret = device_register(&rdev->dev);
        if (ret != 0) {
                put_device(&rdev->dev); --> rdev released
                goto unset_supplies;
        }
...
unset_supplies:
...
        unset_regulator_supplies(rdev); --> use-after-free
...
clean:
        if (dangling_of_gpiod)
                gpiod_put(config->ena_gpiod);
        kfree(rdev);                     --> double free

We add a variable to record the failure of device_register() and
move put_device() down a bit to avoid the above issues.

Fixes: c438b9d01736 ("regulator: core: Move registration of regulator device")
Signed-off-by: Wen Yang <wenyang@linux.alibaba.com>
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: linux-kernel@vger.kernel.org
Link: https://lore.kernel.org/r/20191201030250.38074-1-wenyang@linux.alibaba.com
Signed-off-by: Mark Brown <broonie@kernel.org>
drivers/regulator/core.c