Patch "regulator: core: fix regulator_register() error paths to properly release rdev" has been added to the 5.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    regulator: core: fix regulator_register() error paths to properly release rdev

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     regulator-core-fix-regulator_register-error-paths-to.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 4f8bd756b49337ac1b3d126cab3ec5056abe7791
Author: Wen Yang <wenyang@xxxxxxxxxxxxxxxxx>
Date:   Sun Dec 1 11:02:50 2019 +0800

    regulator: core: fix regulator_register() error paths to properly release rdev
    
    [ Upstream commit a3cde9534ebdafe18a9bbab208df724c57e6c8e8 ]
    
    There are several issues with the error handling code of
    the regulator_register() function:
            ret = device_register(&rdev->dev);
            if (ret != 0) {
                    put_device(&rdev->dev); --> rdev released
                    goto unset_supplies;
            }
    ...
    unset_supplies:
    ...
            unset_regulator_supplies(rdev); --> use-after-free
    ...
    clean:
            if (dangling_of_gpiod)
                    gpiod_put(config->ena_gpiod);
            kfree(rdev);                     --> double free
    
    We add a variable to record the failure of device_register() and
    move put_device() down a bit to avoid the above issues.
    
    Fixes: c438b9d01736 ("regulator: core: Move registration of regulator device")
    Signed-off-by: Wen Yang <wenyang@xxxxxxxxxxxxxxxxx>
    Cc: Liam Girdwood <lgirdwood@xxxxxxxxx>
    Cc: Mark Brown <broonie@xxxxxxxxxx>
    Cc: linux-kernel@xxxxxxxxxxxxxxx
    Link: https://lore.kernel.org/r/20191201030250.38074-1-wenyang@xxxxxxxxxxxxxxxxx
    Signed-off-by: Mark Brown <broonie@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index d66404920976..1dba0bdf3762 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -4992,6 +4992,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
 	struct regulator_dev *rdev;
 	bool dangling_cfg_gpiod = false;
 	bool dangling_of_gpiod = false;
+	bool reg_device_fail = false;
 	struct device *dev;
 	int ret, i;
 
@@ -5177,7 +5178,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
 	dev_set_drvdata(&rdev->dev, rdev);
 	ret = device_register(&rdev->dev);
 	if (ret != 0) {
-		put_device(&rdev->dev);
+		reg_device_fail = true;
 		goto unset_supplies;
 	}
 
@@ -5208,7 +5209,10 @@ regulator_register(const struct regulator_desc *regulator_desc,
 clean:
 	if (dangling_of_gpiod)
 		gpiod_put(config->ena_gpiod);
-	kfree(rdev);
+	if (reg_device_fail)
+		put_device(&rdev->dev);
+	else
+		kfree(rdev);
 	kfree(config);
 rinse:
 	if (dangling_cfg_gpiod)