Merge tag 'libnvdimm-fixes-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm

torvalds · torvalds · commit a989fde763f4 · 2026-03-17T15:19:58.000-07:00
Pull libnvdimm fix from Ira Weiny:

 - Fix old potential use after free bug

* tag 'libnvdimm-fixes-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
  nvdimm/bus: Fix potential use after free in asynchronous initialization
diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
@@ -486,14 +486,15 @@ EXPORT_SYMBOL_GPL(nd_synchronize);
 static void nd_async_device_register(void *d, async_cookie_t cookie)
 {
 	struct device *dev = d;
+	struct device *parent = dev->parent;
 
 	if (device_add(dev) != 0) {
 		dev_err(dev, "%s: failed\n", __func__);
 		put_device(dev);
 	}
 	put_device(dev);
-	if (dev->parent)
-		put_device(dev->parent);
+	if (parent)
+		put_device(parent);
 }
 
 static void nd_async_device_unregister(void *d, async_cookie_t cookie)

Original file line number	Diff line number	Diff line change
`@@ -486,14 +486,15 @@ EXPORT_SYMBOL_GPL(nd_synchronize);`
`486`	`486`	`static void nd_async_device_register(void *d, async_cookie_t cookie)`
`487`	`487`	`{`
`488`	`488`	`struct device *dev = d;`
	`489`	`+ struct device *parent = dev->parent;`
`489`	`490`
`490`	`491`	`if (device_add(dev) != 0) {`
`491`	`492`	`dev_err(dev, "%s: failed\n", __func__);`
`492`	`493`	`put_device(dev);`
`493`	`494`	`}`
`494`	`495`	`put_device(dev);`
`495`		`- if (dev->parent)`
`496`		`- put_device(dev->parent);`
	`496`	`+ if (parent)`
	`497`	`+ put_device(parent);`
`497`	`498`	`}`
`498`	`499`
`499`	`500`	`static void nd_async_device_unregister(void *d, async_cookie_t cookie)`