From: Johan Hovold <johan@hovoldconsulting.com>
Date: Wed, 21 Oct 2015 09:51:42 +0000 (+0200)
Subject: greybus: endo: fix use-after-free in error path
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=16cd787d2d54a47b1d8575bb96bff4b0edc7000b;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git

greybus: endo: fix use-after-free in error path

Fix use-after-free in endo-registration error path by moving the
id-release to the device release function.

Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---

diff --git a/drivers/staging/greybus/endo.c b/drivers/staging/greybus/endo.c
index 84d695df2d62..c0dc43ff6a5c 100644
--- a/drivers/staging/greybus/endo.c
+++ b/drivers/staging/greybus/endo.c
@@ -113,6 +113,7 @@ static void gb_endo_release(struct device *dev)
 {
 	struct gb_endo *endo = to_gb_endo(dev);
 
+	ida_simple_remove(&greybus_endo_id_map, endo->dev_id);
 	kfree(endo);
 }
 
@@ -462,7 +463,6 @@ static int gb_endo_register(struct greybus_host_device *hd,
 		dev_err(hd->parent, "failed to add endo device of id 0x%04x\n",
 			endo->id);
 		put_device(&endo->dev);
-		ida_simple_remove(&greybus_endo_id_map, endo->dev_id);
 	}
 
 	return retval;
@@ -518,7 +518,6 @@ void gb_endo_remove(struct gb_endo *endo)
 	/* remove all modules for this endo */
 	gb_module_remove_all(endo);
 
-	ida_simple_remove(&greybus_endo_id_map, endo->dev_id);
 	device_unregister(&endo->dev);
 }