diff options
| author | Lothar Waßmann <LW@KARO-electronics.de> | 2011-11-28 15:38:37 +0100 |
|---|---|---|
| committer | Mark Brown <broonie@opensource.wolfsonmicro.com> | 2011-11-28 14:44:38 +0000 |
| commit | 58fb5cf5d1edb7e306574833ee55d732918c89e3 (patch) | |
| tree | 56eeb31660956d2795ca068830c603d0d240c34b /drivers/regulator | |
| parent | d4d6373c1109b11c8118340be97ae31b8f94d66a (diff) | |
| download | linux-58fb5cf5d1edb7e306574833ee55d732918c89e3.tar.bz2 | |
regulator: fix use after free bug
This is caused by dereferencing 'rdev' after device_unregister() in
the regulator_unregister() function. 'rdev' is freed by
device_unregister(), so it must not be dereferenced after this call.
[Edited commit message for legibility -- broonie]
Signed-off-by: Lothar Waßmann <LW@KARO-electronics.de>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Diffstat (limited to 'drivers/regulator')
| -rw-r--r-- | drivers/regulator/core.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c index 669d02160221..938398f3e869 100644 --- a/drivers/regulator/core.c +++ b/drivers/regulator/core.c @@ -2799,8 +2799,8 @@ void regulator_unregister(struct regulator_dev *rdev) list_del(&rdev->list); if (rdev->supply) regulator_put(rdev->supply); - device_unregister(&rdev->dev); kfree(rdev->constraints); + device_unregister(&rdev->dev); mutex_unlock(®ulator_list_mutex); } EXPORT_SYMBOL_GPL(regulator_unregister); |