This is a note to let you know that I've just added the patch titled regulator: core: fix regulator_register() error paths to properly release rdev to the 5.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: regulator-core-fix-regulator_register-error-paths-to.patch and it can be found in the queue-5.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. commit 4f8bd756b49337ac1b3d126cab3ec5056abe7791 Author: Wen Yang <wenyang@xxxxxxxxxxxxxxxxx> Date: Sun Dec 1 11:02:50 2019 +0800 regulator: core: fix regulator_register() error paths to properly release rdev [ Upstream commit a3cde9534ebdafe18a9bbab208df724c57e6c8e8 ] There are several issues with the error handling code of the regulator_register() function: ret = device_register(&rdev->dev); if (ret != 0) { put_device(&rdev->dev); --> rdev released goto unset_supplies; } ... unset_supplies: ... unset_regulator_supplies(rdev); --> use-after-free ... clean: if (dangling_of_gpiod) gpiod_put(config->ena_gpiod); kfree(rdev); --> double free We add a variable to record the failure of device_register() and move put_device() down a bit to avoid the above issues. Fixes: c438b9d01736 ("regulator: core: Move registration of regulator device") Signed-off-by: Wen Yang <wenyang@xxxxxxxxxxxxxxxxx> Cc: Liam Girdwood <lgirdwood@xxxxxxxxx> Cc: Mark Brown <broonie@xxxxxxxxxx> Cc: linux-kernel@xxxxxxxxxxxxxxx Link: https://lore.kernel.org/r/20191201030250.38074-1-wenyang@xxxxxxxxxxxxxxxxx Signed-off-by: Mark Brown <broonie@xxxxxxxxxx> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx> diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c index d66404920976..1dba0bdf3762 100644 --- a/drivers/regulator/core.c +++ b/drivers/regulator/core.c @@ -4992,6 +4992,7 @@ regulator_register(const struct regulator_desc *regulator_desc, struct regulator_dev *rdev; bool dangling_cfg_gpiod = false; bool dangling_of_gpiod = false; + bool reg_device_fail = false; struct device *dev; int ret, i; @@ -5177,7 +5178,7 @@ regulator_register(const struct regulator_desc *regulator_desc, dev_set_drvdata(&rdev->dev, rdev); ret = device_register(&rdev->dev); if (ret != 0) { - put_device(&rdev->dev); + reg_device_fail = true; goto unset_supplies; } @@ -5208,7 +5209,10 @@ regulator_register(const struct regulator_desc *regulator_desc, clean: if (dangling_of_gpiod) gpiod_put(config->ena_gpiod); - kfree(rdev); + if (reg_device_fail) + put_device(&rdev->dev); + else + kfree(rdev); kfree(config); rinse: if (dangling_cfg_gpiod)