[PATCH] nvmem: core: Fix nvmem use-after-free in nvmem_cell_put()

[Wentao Liang]

__nvmem_device_put() drops the last reference to the nvmem device, which
runs nvmem_device_release() and unregisters and frees the device, but
nvmem_layout_module_put() then dereferences nvmem->layout on that freed
device.

Call nvmem_layout_module_put() before __nvmem_device_put() so the layout
is still accessed while the device is alive.

Fixes: fc29fd821d9ac ("nvmem: core: Rework layouts to become regular devices")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/nvmem/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 311cb2e5a5c0..4df7efde2cd2 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -1593,8 +1593,8 @@ void nvmem_cell_put(struct nvmem_cell *cell)
 		kfree_const(cell->id);
 
 	kfree(cell);
-	__nvmem_device_put(nvmem);
 	nvmem_layout_module_put(nvmem);
+	__nvmem_device_put(nvmem);
 }
 EXPORT_SYMBOL_GPL(nvmem_cell_put);
 
-- 
2.34.1