averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-08-09 06:14:34 +02:00
Code Issues Packages Projects Releases Wiki Activity

ata: pata_sl82c105: fix bridge revision use-after-free

Browse Source 
pci_get_slot() returns a referenced PCI device. Commit 44c10138fd
("PCI: Change all drivers to use pci_device->revision") replaced a
configuration-space read with direct access to the cached revision field,
but left that access after pci_dev_put(). The bridge may therefore be freed
before its revision is read.

Read the revision before dropping the reference.

Fixes: 44c10138fd ("PCI: Change all drivers to use pci_device->revision")
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
Reviewed-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
This commit is contained in:
Hongyan Xu
2026-08-07 00:55:53 +09:00
committed by Damien Le Moal
parent 3971921a05
commit 7700a31039
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/ata/pata_sl82c105.c
+3 -1
View File
@@ -264,6 +264,7 @@ static struct ata_port_operations sl82c105_port_ops = {
static int sl82c105_bridge_revision(struct pci_dev *pdev)
{
struct pci_dev *bridge;
u8 revision;
/*
* The bridge should be part of the same device, but function 0.
@@ -285,8 +286,9 @@ static int sl82c105_bridge_revision(struct pci_dev *pdev)
/*
* We need to find function 0's revision, not function 1
*/
revision = bridge->revision;
pci_dev_put(bridge);
return bridge->revision;
return revision;
}
static void sl82c105_fixup(struct pci_dev *pdev)