[PATCH] nvmem: core: Fix nvmem use-after-free in nvmem_cell_put()

[PATCH] nvmem: core: Fix nvmem use-after-free in nvmem_cell_put()

[Wentao Liang]

__nvmem_device_put() drops the last reference to the nvmem device, which
runs nvmem_device_release() and unregisters and frees the device, but
nvmem_layout_module_put() then dereferences nvmem->layout on that freed
device.

Call nvmem_layout_module_put() before __nvmem_device_put() so the layout
is still accessed while the device is alive.

Fixes: fc29fd821d9ac ("nvmem: core: Rework layouts to become regular devices")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/nvmem/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 311cb2e5a5c0..4df7efde2cd2 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -1593,8 +1593,8 @@ void nvmem_cell_put(struct nvmem_cell *cell)
 		kfree_const(cell->id);
 
 	kfree(cell);
-	__nvmem_device_put(nvmem);
 	nvmem_layout_module_put(nvmem);
+	__nvmem_device_put(nvmem);
 }
 EXPORT_SYMBOL_GPL(nvmem_cell_put);
 
-- 
2.34.1

Re: [PATCH] nvmem: core: Fix nvmem use-after-free in nvmem_cell_put()

[Srinivas Kandagatla]

On 9/17/26 1:33 PM, Wentao Liang wrote:
> __nvmem_device_put() drops the last reference to the nvmem device, which
> runs nvmem_device_release() and unregisters and frees the device, but
> nvmem_layout_module_put() then dereferences nvmem->layout on that freed
> device.
> 
> Call nvmem_layout_module_put() before __nvmem_device_put() so the layout
> is still accessed while the device is alive.


This is almost 3 or 4th time, am seeing patches from this email,
repeating and sending duplicate patches with out checking correct tree
and without checking mailing list.

Please do not waste maintainers time.

this is duplicate patch of 5b6b6fc49189

--srini
> 
> Fixes: fc29fd821d9ac ("nvmem: core: Rework layouts to become regular devices")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/nvmem/core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
> index 311cb2e5a5c0..4df7efde2cd2 100644
> --- a/drivers/nvmem/core.c
> +++ b/drivers/nvmem/core.c
> @@ -1593,8 +1593,8 @@ void nvmem_cell_put(struct nvmem_cell *cell)
>  		kfree_const(cell->id);
>  
>  	kfree(cell);
> -	__nvmem_device_put(nvmem);
>  	nvmem_layout_module_put(nvmem);
> +	__nvmem_device_put(nvmem);
>  }
>  EXPORT_SYMBOL_GPL(nvmem_cell_put);
>