diff options
| author | Guenter Roeck <linux@roeck-us.net> | 2026-08-20 10:51:50 -0700 |
|---|---|---|
| committer | Guenter Roeck <linux@roeck-us.net> | 2026-09-07 07:22:19 -0700 |
| commit | 354ccc99b2dc8ba0cf6d4de34e520bcf6ecca5c2 (patch) | |
| tree | 771af900905184c884afce4fb3bf250602e6afb0 /scripts/basic | |
| parent | b4fffa75c1d6f87e6dc6191dec900f2b5bd23a1c (diff) | |
| download | linux-354ccc99b2dc8ba0cf6d4de34e520bcf6ecca5c2.tar.gz linux-354ccc99b2dc8ba0cf6d4de34e520bcf6ecca5c2.zip | |
hwmon: Fix potential UAF in pec_store
Sashiko reports:
In pec_store(), a guard(mutex)(&hwdev->lock) is taken. If the chip write
operation returns an error other than -EOPNOTSUPP, the code jumps to the
put label, which calls put_device(hdev). If this drops the final reference,
the device is freed. When the function then returns, the guard cleanup
function runs and attempts to unlock the freed mutex.
Use scoped_guard() instead of guard() to avoid the problem.
Fixes: 3ad2a7b9b15d5 ("hwmon: Serialize accesses in hwmon core")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Diffstat (limited to 'scripts/basic')
0 files changed, 0 insertions, 0 deletions
