Re: [PATCH] i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()
From: Andi Shyti
Date: Tue Jul 14 2026 - 18:10:53 EST
Hi Xuanqiang,
On Tue, Jul 14, 2026 at 11:08:08PM +0800, Xuanqiang Luo wrote:
> From: Xuanqiang Luo <luoxuanqiang@xxxxxxxxxx>
>
> If devm_platform_get_and_ioremap_resource() returns an error,
> mlxbf_i2c_init_resource() frees tmp_res before reading tmp_res->io to
> get the error code. This results in a use-after-free.
>
> Save the error code before freeing tmp_res.
>
> Fixes: b5b5b32081cd ("i2c: mlxbf: I2C SMBus driver for Mellanox BlueField SoC")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Xuanqiang Luo <luoxuanqiang@xxxxxxxxxx>
merged to i2c/i2c-fixes.
Thanks,
Andi