[PATCH] media: ivsc: Fix csi_dev use-after-free in mei_ace_setup_dev_link()

[Wentao Liang]

device_link_add() only takes a reference to the supplier when the
link is created successfully.  When it fails it returns NULL without
taking one, so the put_device(csi_dev) before the error check can
drop the last reference to csi_dev and dev_name(csi_dev) then
dereferences a freed device.

Move the put_device() below the error check and release the
reference through the existing err_put label on the failure path so
that csi_dev is no longer touched after it has been put.

Fixes: 765abb76f51f ("media: ivsc: Release csi_dev reference early in mei_ace_setup_dev_link()")
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/media/pci/intel/ivsc/mei_ace.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/pci/intel/ivsc/mei_ace.c b/drivers/media/pci/intel/ivsc/mei_ace.c
index b306a320b70f..bb57656fc85a 100644
--- a/drivers/media/pci/intel/ivsc/mei_ace.c
+++ b/drivers/media/pci/intel/ivsc/mei_ace.c
@@ -414,13 +414,13 @@ static int mei_ace_setup_dev_link(struct mei_ace *ace)
 	/* setup link between mei_ace and mei_csi */
 	ace->csi_link = device_link_add(csi_dev, dev, DL_FLAG_PM_RUNTIME |
 					DL_FLAG_RPM_ACTIVE | DL_FLAG_STATELESS);
-	put_device(csi_dev);
 	if (!ace->csi_link) {
 		ret = -EINVAL;
 		dev_err(dev, "failed to link to %s\n", dev_name(csi_dev));
-		goto err;
+		goto err_put;
 	}
 
+	put_device(csi_dev);
 	ace->csi_dev = csi_dev;
 
 	return 0;
-- 
2.34.1