diff options
| author | Hongyan Xu <getshell@seu.edu.cn> | 2026-08-06 14:06:28 +0800 |
|---|---|---|
| committer | Damien Le Moal <dlemoal@kernel.org> | 2026-08-07 00:55:53 +0900 |
| commit | 7700a31039cdc6715cb6cce7e7a664ee4e945f67 (patch) | |
| tree | ae7a05b6b30ed8bf6e196c8cb362f97ce480d923 | |
| parent | 3971921a055330669b281962ff723d1abb76a58c (diff) | |
ata: pata_sl82c105: fix bridge revision use-after-free
pci_get_slot() returns a referenced PCI device. Commit 44c10138fd4b
("PCI: Change all drivers to use pci_device->revision") replaced a
configuration-space read with direct access to the cached revision field,
but left that access after pci_dev_put(). The bridge may therefore be freed
before its revision is read.
Read the revision before dropping the reference.
Fixes: 44c10138fd4b ("PCI: Change all drivers to use pci_device->revision")
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
Reviewed-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
| -rw-r--r-- | drivers/ata/pata_sl82c105.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/ata/pata_sl82c105.c b/drivers/ata/pata_sl82c105.c index 2d24c6b3e9d9..25bce3fe2a10 100644 --- a/drivers/ata/pata_sl82c105.c +++ b/drivers/ata/pata_sl82c105.c @@ -264,6 +264,7 @@ static struct ata_port_operations sl82c105_port_ops = { static int sl82c105_bridge_revision(struct pci_dev *pdev) { struct pci_dev *bridge; + u8 revision; /* * The bridge should be part of the same device, but function 0. @@ -285,8 +286,9 @@ static int sl82c105_bridge_revision(struct pci_dev *pdev) /* * We need to find function 0's revision, not function 1 */ + revision = bridge->revision; pci_dev_put(bridge); - return bridge->revision; + return revision; } static void sl82c105_fixup(struct pci_dev *pdev) |