Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ee1e2028 authored by David Collins's avatar David Collins
Browse files

msm: rpm-regulator-smd: correct use-after-free in rpm_vreg_device_remove 



Modify the rpm_vreg_device_remove() function so that the reg
pointer is not dereferenced after being freed.

Change-Id: I0bc2c38a00c5d6b783f52c0ae0f1faa31d3a1e4d
CRs-Fixed: 564463
Signed-off-by: default avatarDavid Collins <collinsd@codeaurora.org>
parent ff585cbf

arch/arm/mach-msm/rpm-regulator-smd.c

+4 −2
Original line number Diff line number Diff line
@@ -1281,14 +1281,16 @@ static int rpm_vreg_device_remove(struct platform_device *pdev) 
{

	struct device *dev = &pdev->dev;

	struct rpm_regulator *reg;

	struct rpm_vreg *rpm_vreg;



	reg = platform_get_drvdata(pdev);

	if (reg) {

		rpm_vreg_lock(reg->rpm_vreg);

		rpm_vreg = reg->rpm_vreg;

		rpm_vreg_lock(rpm_vreg);

		regulator_unregister(reg->rdev);

		list_del(&reg->list);

		kfree(reg);

		rpm_vreg_unlock(reg->rpm_vreg);

		rpm_vreg_unlock(rpm_vreg);

	} else {

		dev_err(dev, "%s: drvdata missing\n", __func__);

		return -EINVAL;