From b71c2523f9f7bbe2a275fd32c1f7fc90af854c1c Mon Sep 17 00:00:00 2001 From: Yang Yingliang Date: Thu, 8 May 2025 16:19:01 +0800 Subject: [PATCH 1/2] mISDN: fix possible memory leak in mISDN_register_device() stable inclusion from stable-v4.19.265 commit a636fc5a7cabd05699b5692ad838c2c7a3abec7b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BRX CVE: CVE-2022-49915 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a636fc5a7cabd05699b5692ad838c2c7a3abec7b -------------------------------- [ Upstream commit e7d1d4d9ac0dfa40be4c2c8abd0731659869b297 ] Afer commit 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array"), the name of device is allocated dynamically, add put_device() to give up the reference, so that the name can be freed in kobject_cleanup() when the refcount is 0. Set device class before put_device() to avoid null release() function WARN message in device_release(). Fixes: 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array") Signed-off-by: Yang Yingliang Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Signed-off-by: Huang Xiaojia --- drivers/isdn/mISDN/core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/isdn/mISDN/core.c b/drivers/isdn/mISDN/core.c index faf505462a4f..8ecf7acd0954 100644 --- a/drivers/isdn/mISDN/core.c +++ b/drivers/isdn/mISDN/core.c @@ -242,11 +242,12 @@ mISDN_register_device(struct mISDNdevice *dev, if (debug & DEBUG_CORE) printk(KERN_DEBUG "mISDN_register %s %d\n", dev_name(&dev->dev), dev->id); + dev->dev.class = &mISDN_class; + err = create_stack(dev); if (err) goto error1; - dev->dev.class = &mISDN_class; dev->dev.platform_data = dev; dev->dev.parent = parent; dev_set_drvdata(&dev->dev, dev); @@ -258,8 +259,8 @@ mISDN_register_device(struct mISDNdevice *dev, error3: delete_stack(dev); - return err; error1: + put_device(&dev->dev); return err; } -- Gitee From 15cdd24e413f17d35e5dbb6755ab0d1edf8ca147 Mon Sep 17 00:00:00 2001 From: Wang ShaoBo Date: Thu, 8 May 2025 16:19:02 +0800 Subject: [PATCH 2/2] mISDN: fix misuse of put_device() in mISDN_register_device() stable inclusion from stable-v4.19.267 commit d40b35a7922f4df3767ad6fb8ef3dc86e31d7ba3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BRX CVE: CVE-2022-49915 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d40b35a7922f4df3767ad6fb8ef3dc86e31d7ba3 -------------------------------- [ Upstream commit 2d25107e111a85c56f601a5470f1780ec054e6ac ] We should not release reference by put_device() before calling device_initialize(). Fixes: e7d1d4d9ac0d ("mISDN: fix possible memory leak in mISDN_register_device()") Signed-off-by: Wang ShaoBo Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Signed-off-by: Huang Xiaojia --- drivers/isdn/mISDN/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/isdn/mISDN/core.c b/drivers/isdn/mISDN/core.c index 8ecf7acd0954..6bd97b642a04 100644 --- a/drivers/isdn/mISDN/core.c +++ b/drivers/isdn/mISDN/core.c @@ -231,7 +231,7 @@ mISDN_register_device(struct mISDNdevice *dev, err = get_free_devid(); if (err < 0) - goto error1; + return err; dev->id = err; device_initialize(&dev->dev); -- Gitee