device_link_add() only takes a reference to the supplier when the
link is created successfully. When it fails it returns NULL without
taking one, so the put_device(csi_dev) before the error check can
drop the last reference to csi_dev and dev_name(csi_dev) then
dereferences a freed device.
Move the put_device() below the error check and release the
reference through the existing err_put label on the failure path so
that csi_dev is no longer touched after it has been put.
Fixes: 765abb76f51f ("media: ivsc: Release csi_dev reference early in mei_ace_setup_dev_link()")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
drivers/media/pci/intel/ivsc/mei_ace.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/pci/intel/ivsc/mei_ace.c b/drivers/media/pci/intel/ivsc/mei_ace.c
index b306a320b70f..bb57656fc85a 100644
--- a/drivers/media/pci/intel/ivsc/mei_ace.c
+++ b/drivers/media/pci/intel/ivsc/mei_ace.c
@@ -414,13 +414,13 @@ static int mei_ace_setup_dev_link(struct mei_ace *ace)
/* setup link between mei_ace and mei_csi */
ace->csi_link = device_link_add(csi_dev, dev, DL_FLAG_PM_RUNTIME |
DL_FLAG_RPM_ACTIVE | DL_FLAG_STATELESS);
- put_device(csi_dev);
if (!ace->csi_link) {
ret = -EINVAL;
dev_err(dev, "failed to link to %s\n", dev_name(csi_dev));
- goto err;
+ goto err_put;
}
+ put_device(csi_dev);
ace->csi_dev = csi_dev;
return 0;
--
2.34.1