[PATCH net] net: wan: framer: fix potential UAF in framer_provider_simple_of_xlate()

[Dmitry Torokhov <dmitry.torokhov@gmail.com>]

The implementation put_device()s located device and then uses
container_of() on the pointer. The device may disappear by that time,
resulting in UAF.

Fix the problem by keeping the reference to the framer device, and
avoid getting an extra reference to it in framer_get().

Fixes: dcacb364772e ("net: wan: framer: Simplify API framer_provider_simple_of_xlate() implementation")
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/net/wan/framer/framer-core.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/net/wan/framer/framer-core.c b/drivers/net/wan/framer/framer-core.c
index bf7ac7dd2804..397fabc3da4e 100644
--- a/drivers/net/wan/framer/framer-core.c
+++ b/drivers/net/wan/framer/framer-core.c
@@ -482,8 +482,6 @@ struct framer *framer_get(struct device *dev, const char *con_id)
 	if (IS_ERR(framer))
 		return framer;
 
-	get_device(&framer->dev);
-
 	if (!try_module_get(framer->ops->owner)) {
 		ret = -EPROBE_DEFER;
 		goto err_put_device;
@@ -749,7 +747,6 @@ struct framer *framer_provider_simple_of_xlate(struct device *dev,
 	if (!target_dev)
 		return ERR_PTR(-ENODEV);
 
-	put_device(target_dev);
 	return dev_to_framer(target_dev);
 }
 EXPORT_SYMBOL_GPL(framer_provider_simple_of_xlate);
-- 
2.53.0.345.g96ddfc5eaa-goog


-- 
Dmitry