From c90aab9c96c2a7f7bf3f7a54167dc5c0ba2b178c Mon Sep 17 00:00:00 2001 From: Jerome Marchand Date: Mon, 25 Jul 2016 16:13:32 +0200 Subject: [PATCH] platform driver: fix use-after-free in platform_device_del() In platform_device_del(), the device is still used after a call to device_del(). At this point there is no guarantee that the device is still there and there could be a use-after-free access. Move the call to device_remove_properties() before device_del() to fix that. Signed-off-by: Jerome Marchand Signed-off-by: Greg Kroah-Hartman --- drivers/base/platform.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/base/platform.c b/drivers/base/platform.c index 6482d47deb50..f57fff3f268b 100644 --- a/drivers/base/platform.c +++ b/drivers/base/platform.c @@ -434,6 +434,7 @@ void platform_device_del(struct platform_device *pdev) int i; if (pdev) { + device_remove_properties(&pdev->dev); device_del(&pdev->dev); if (pdev->id_auto) { @@ -446,8 +447,6 @@ void platform_device_del(struct platform_device *pdev) if (r->parent) release_resource(r); } - - device_remove_properties(&pdev->dev); } } EXPORT_SYMBOL_GPL(platform_device_del);