i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()

If devm_platform_get_and_ioremap_resource() returns an error,
mlxbf_i2c_init_resource() frees tmp_res before reading tmp_res->io to
get the error code. This results in a use-after-free.

Save the error code before freeing tmp_res.

Fixes: b5b5b32081cd ("i2c: mlxbf: I2C SMBus driver for Mellanox BlueField SoC")
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Cc: <stable@vger.kernel.org> # v5.10+
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260714150808.85045-1-xuanqiang.luo@linux.dev

diff --git a/drivers/i2c/busses/i2c-mlxbf.c b/drivers/i2c/busses/i2c-mlxbf.c
index 6c1cfe9ec8accefaa3f95424393953ff3b869ff6..e33512b25353189e1e54ee0c8e5c1d7745d0dc9d 100644 (file)
--- a/drivers/i2c/busses/i2c-mlxbf.c
+++ b/drivers/i2c/busses/i2c-mlxbf.c
@@ -1051,8 +1051,10 @@ static int mlxbf_i2c_init_resource(struct platform_device *pdev,
 
        tmp_res->io = devm_platform_get_and_ioremap_resource(pdev, type, &tmp_res->params);
        if (IS_ERR(tmp_res->io)) {
+               int ret = PTR_ERR(tmp_res->io);
+
                devm_kfree(dev, tmp_res);
-               return PTR_ERR(tmp_res->io);
+               return ret;
        }
 
        tmp_res->type = type;