diff options
| author | Lothar Waßmann <LW@KARO-electronics.de> | 2011-11-28 15:38:37 +0100 |
|---|---|---|
| committer | Mark Brown <broonie@opensource.wolfsonmicro.com> | 2011-11-28 15:44:38 +0100 |
| commit | 58fb5cf5d1edb7e306574833ee55d732918c89e3 (patch) | |
| tree | 56eeb31660956d2795ca068830c603d0d240c34b | |
| parent | regulator: aat2870: Fix the logic of checking if no id is matched in aat2870_... (diff) | |
| download | linux-58fb5cf5d1edb7e306574833ee55d732918c89e3.tar.xz linux-58fb5cf5d1edb7e306574833ee55d732918c89e3.zip | |
regulator: fix use after free bug
This is caused by dereferencing 'rdev' after device_unregister() in
the regulator_unregister() function. 'rdev' is freed by
device_unregister(), so it must not be dereferenced after this call.
[Edited commit message for legibility -- broonie]
Signed-off-by: Lothar Waßmann <LW@KARO-electronics.de>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
| -rw-r--r-- | drivers/regulator/core.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c index 669d02160221..938398f3e869 100644 --- a/drivers/regulator/core.c +++ b/drivers/regulator/core.c @@ -2799,8 +2799,8 @@ void regulator_unregister(struct regulator_dev *rdev) list_del(&rdev->list); if (rdev->supply) regulator_put(rdev->supply); - device_unregister(&rdev->dev); kfree(rdev->constraints); + device_unregister(&rdev->dev); mutex_unlock(®ulator_list_mutex); } EXPORT_SYMBOL_GPL(regulator_unregister); |