diff options
| author | Guenter Roeck <linux@roeck-us.net> | 2026-08-20 10:51:50 -0700 |
|---|---|---|
| committer | Guenter Roeck <linux@roeck-us.net> | 2026-09-07 07:22:19 -0700 |
| commit | 354ccc99b2dc8ba0cf6d4de34e520bcf6ecca5c2 (patch) | |
| tree | 771af900905184c884afce4fb3bf250602e6afb0 | |
| parent | b4fffa75c1d6f87e6dc6191dec900f2b5bd23a1c (diff) | |
| download | linux-next-354ccc99b2dc8ba0cf6d4de34e520bcf6ecca5c2.tar.gz linux-next-354ccc99b2dc8ba0cf6d4de34e520bcf6ecca5c2.zip | |
hwmon: Fix potential UAF in pec_store
Sashiko reports:
In pec_store(), a guard(mutex)(&hwdev->lock) is taken. If the chip write
operation returns an error other than -EOPNOTSUPP, the code jumps to the
put label, which calls put_device(hdev). If this drops the final reference,
the device is freed. When the function then returns, the guard cleanup
function runs and attempts to unlock the freed mutex.
Use scoped_guard() instead of guard() to avoid the problem.
Fixes: 3ad2a7b9b15d5 ("hwmon: Serialize accesses in hwmon core")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
| -rw-r--r-- | drivers/hwmon/hwmon.c | 21 |
1 files changed, 10 insertions, 11 deletions
diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c index 41755910a25a..3e65fc6d25eb 100644 --- a/drivers/hwmon/hwmon.c +++ b/drivers/hwmon/hwmon.c @@ -371,18 +371,17 @@ static ssize_t pec_store(struct device *dev, const struct device_attribute *deva * handling is not required. */ hwdev = to_hwmon_device(hdev); - guard(mutex)(&hwdev->lock); - if (hwdev->chip->ops->write) { - err = hwdev->chip->ops->write(hdev, hwmon_chip, hwmon_chip_pec, 0, val); - if (err && err != -EOPNOTSUPP) - goto put; + scoped_guard(mutex, &hwdev->lock) { + if (hwdev->chip->ops->write) { + err = hwdev->chip->ops->write(hdev, hwmon_chip, hwmon_chip_pec, 0, val); + if (err && err != -EOPNOTSUPP) + goto put; + } + if (!val) + client->flags &= ~I2C_CLIENT_PEC; + else + client->flags |= I2C_CLIENT_PEC; } - - if (!val) - client->flags &= ~I2C_CLIENT_PEC; - else - client->flags |= I2C_CLIENT_PEC; - err = count; put: put_device(hdev); |