tag fb00a9b9fcb52b5177e999d1f351e2cfff2b4c2d
tagger Iwona Winiarska <iwona.winiarska@intel.com> Wed Aug 03 01:55:41 2022 +0200
object cacbac434f6b020f99d4af648843465fd9eba167

Update peci-next for v6.0-rc1

Two minor fixes:
* cpu
- Fix use-after-free in adev_release()

* aspeed
- Fix error check for platform_get_irq()

commit cacbac434f6b020f99d4af648843465fd9eba167
author Iwona Winiarska <iwona.winiarska@intel.com> Tue Jul 05 12:15:01 2022 +0200
committer Iwona Winiarska <iwona.winiarska@intel.com> Wed Aug 03 00:56:17 2022 +0200
tree 9db5ba253635911b1143c5d0ca8ae3b184d68a6e
parent 2d0cd86022399db8aa86cc9647470e66bc7420e2

peci: cpu: Fix use-after-free in adev_release()

When auxiliary_device_add() returns an error, auxiliary_device_uninit()
is called, which causes refcount for device to be decremented and
.release callback will be triggered.

Because adev_release() re-calls auxiliary_device_uninit(), it will cause
use-after-free:
[ 1269.455172] WARNING: CPU: 0 PID: 14267 at lib/refcount.c:28 refcount_warn_saturate+0x110/0x15
[ 1269.464007] refcount_t: underflow; use-after-free.

Reported-by: Jianglei Nie <niejianglei2021@163.com>
Signed-off-by: Iwona Winiarska <iwona.winiarska@intel.com>
Link: https://lore.kernel.org/r/20220705101501.298395-1-iwona.winiarska@intel.com