This is a note to let you know that I've just added the patch titled regulator: fix use after free issue to the 5.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: regulator-fix-use-after-free-issue.patch and it can be found in the queue-5.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. commit 6f8a46b81e4b80f695dd050188432da2f59b81a1 Author: Wen Yang <wenyang@xxxxxxxxxxxxxxxxx> Date: Sun Nov 24 22:58:35 2019 +0800 regulator: fix use after free issue [ Upstream commit 4affd79a125ac91e6a53be843ea3960a8fc00cbb ] This is caused by dereferencing 'rdev' after put_device() in the _regulator_get()/_regulator_put() functions. This patch just moves the put_device() down a bit to avoid the issue. Signed-off-by: Wen Yang <wenyang@xxxxxxxxxxxxxxxxx> Cc: Liam Girdwood <lgirdwood@xxxxxxxxx> Cc: Mark Brown <broonie@xxxxxxxxxx> Cc: linux-kernel@xxxxxxxxxxxxxxx Link: https://lore.kernel.org/r/20191124145835.25999-1-wenyang@xxxxxxxxxxxxxxxxx Signed-off-by: Mark Brown <broonie@xxxxxxxxxx> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx> diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c index 87bc06b386a0..d66404920976 100644 --- a/drivers/regulator/core.c +++ b/drivers/regulator/core.c @@ -1937,8 +1937,8 @@ struct regulator *_regulator_get(struct device *dev, const char *id, regulator = create_regulator(rdev, dev, id); if (regulator == NULL) { regulator = ERR_PTR(-ENOMEM); - put_device(&rdev->dev); module_put(rdev->owner); + put_device(&rdev->dev); return regulator; } @@ -2059,13 +2059,13 @@ static void _regulator_put(struct regulator *regulator) rdev->open_count--; rdev->exclusive = 0; - put_device(&rdev->dev); regulator_unlock(rdev); kfree_const(regulator->supply_name); kfree(regulator); module_put(rdev->owner); + put_device(&rdev->dev); } /**