mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
mctp_i3c_probe() drops busdevs_lock after finding the matching bus. A
concurrent I3C_NOTIFY_BUS_REMOVE can then unregister and free the bus
netdev before probe passes its private data to mctp_i3c_add_device().
The latter consequently adds a list node through a freed mbus pointer.
Keep busdevs_lock held until the device has been added. This also
satisfies the __must_hold annotation on mctp_i3c_add_device().
Fixes:
|
History
|
|
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| mctp-i2c.c | ||
| mctp-i3c.c | ||
| mctp-serial.c | ||
| mctp-usb.c | ||
| mctp-usblib-test.c | ||
| mctp-usblib.c | ||