[PATCH] pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()

[Wentao Liang]

pwrseq_debugfs_seq_next() declares the 'next' device pointer with
__free(put_device), which causes put_device() to drop the reference
as soon as the variable goes out of scope. Returning 'next' directly
thus gives the caller a pointer whose reference has already been
decremented, resulting in a use-after-free.

Fix this by returning no_free_ptr(next) so that the automatic
cleanup is suppressed and ownership is properly transferred to
the caller.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: 249ebf3f65f8 ("power: sequencing: implement the pwrseq core")
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/power/sequencing/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/power/sequencing/core.c b/drivers/power/sequencing/core.c
index 4dff71be11b6..1ec4f393994d 100644
--- a/drivers/power/sequencing/core.c
+++ b/drivers/power/sequencing/core.c
@@ -1010,7 +1010,7 @@ static void *pwrseq_debugfs_seq_next(struct seq_file *seq, void *data,
 
 	struct device *next __free(put_device) =
 			bus_find_next_device(&pwrseq_bus, curr);
-	return next;
+	return_ptr(next);
 }
 
 static void pwrseq_debugfs_seq_show_target(struct seq_file *seq,
-- 
2.34.1