__nvmem_device_put() drops the last reference to the nvmem device, which runs nvmem_device_release() and unregisters and frees the device, but nvmem_layout_module_put() then dereferences nvmem->layout on that freed device. Call nvmem_layout_module_put() before __nvmem_device_put() so the layout is still accessed while the device is alive. Fixes: fc29fd821d9ac ("nvmem: core: Rework layouts to become regular devices") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang --- drivers/nvmem/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c index 311cb2e5a5c0..4df7efde2cd2 100644 --- a/drivers/nvmem/core.c +++ b/drivers/nvmem/core.c @@ -1593,8 +1593,8 @@ void nvmem_cell_put(struct nvmem_cell *cell) kfree_const(cell->id); kfree(cell); - __nvmem_device_put(nvmem); nvmem_layout_module_put(nvmem); + __nvmem_device_put(nvmem); } EXPORT_SYMBOL_GPL(nvmem_cell_put); -- 2.34.1