From patchwork Wed Aug 14 09:39:56 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Krzysztof Kozlowski X-Patchwork-Id: 13763180 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 12530C52D7F for ; Wed, 14 Aug 2024 09:41:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: MIME-Version:Message-ID:Date:Subject:Cc:To:From:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Owner; bh=JmXmcga/zjb6ahfiHPXOSzwplx1CZRP7/PHn0u7sCk0=; b=wyJY10YUYgbmOKCkcsc9K/OR1s 3AbHQVlsSjxrDJeHTj9jsH2/OLRpV/x+lgPvLsqPMAGAnwyecoi4m0t9EpvMPA8tq56pePfYpF9Dq V8OroEJmYR567bqVwPzgSGyNOa/a2K/mtc4mVYwBZF1790a8bAQJoe6rjFjDvaax3xZfApwMwSXZe HLPikbR4X/juMfLoBTqPEtlIr4GcOnTnd2TXA6VHfIxo72Eta0/dppBif2Sibz46B6lC2vgXJhdf3 ksHAppOSlEtHMuv481awdz5vVuynBW4m+LloXCcWaO+GIx/+risuQSA4wqPwuopahrZyytK9hLlJ+ Zqcc9bIg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1seAUy-00000006R33-1fx2; Wed, 14 Aug 2024 09:40:56 +0000 Received: from mail-wm1-x335.google.com ([2a00:1450:4864:20::335]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1seAU7-00000006Qmt-0rSa for linux-arm-kernel@lists.infradead.org; Wed, 14 Aug 2024 09:40:04 +0000 Received: by mail-wm1-x335.google.com with SMTP id 5b1f17b1804b1-429c4a4c6a8so34612945e9.0 for ; Wed, 14 Aug 2024 02:40:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1723628401; x=1724233201; darn=lists.infradead.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=JmXmcga/zjb6ahfiHPXOSzwplx1CZRP7/PHn0u7sCk0=; b=lyJcC9lRybJc2PzhUSSHVcd9xX+tw+rZwiW7jZzhymlHzWIRubFyOqG83j19OXuzMK yIdohHGblj0s50Wuokxyp1v9M3u1RO3qTRRShcFhU2qP92btRdDhFUPOSqDnjurIRLGo sEuhULa3cJAQ9gbQIvofnx4SxRyaWzdyQ2EtWnGdmwpEBUXuwECM2AdPk9VYVmOF119J i0WEfpbYRFLpw5wMceZdlEFo7IKhSg2YvqYw94xmIX+gFA3T4prP66Fgk3On54yzzWON aenTzr8MrBSVC8qcr3wuE3cVp/bIvN8/OG0ewiokQuMtVE92JDdroIjR2OwkRXRvdG2X kqow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1723628401; x=1724233201; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=JmXmcga/zjb6ahfiHPXOSzwplx1CZRP7/PHn0u7sCk0=; b=C7eZ0ZlV5Qq4gxUNIpZpVPulZ249bb2Q24LcnIV1UZXvdN+zVr0ATulNDyZLXlVx+n rd9HRY0oIQmSySrpgDpv7SXFgOjlTQyP3PMEVL7SvxeEx2s4TYBBIF4SMUMydWAfkE+b Ni8QsEzWnIwPfRueYUtZ+K7I71+1BVqZUz4lDptA5LrkcSWUcputZclBFBp7/Ai7JVZG X2zLIB8ZpFCjNXdonI23L2rcC3whyjBLA/jW+AvqYkQtt1qDRhdriOtWFotL3qcNObLS 6X9p29+Nyr+B1+eISe/p4Cc0fi1/aVqTENFEJSZuIol2oBmUmtkrgThNXhPyc4RGgQDw 25OA== X-Forwarded-Encrypted: i=1; AJvYcCWMoHXgoIyoLMKu/rjpkYl0ifSyG8MlQhFTY2nzbpzEdlKDZcDCBodLDAB+7B3JUg2o7SCipBXHySqmR8g0WF+M7z950MK6K4R5Kkt36lAeZ7cUcPY= X-Gm-Message-State: AOJu0YzH/16lPhFL7tGFu8tQXf9WPct/sF9Yr+DMDEHbzgDWY3paZXV4 sOscWCBCvFh12aBoYPYje0KynHVEux4EKySHAow1VA5oXbqWZ46CqwC8BbnKpAA= X-Google-Smtp-Source: AGHT+IF/bJMKfHmeWBSdbtMjSNM/VzBYMVOeE4F12fOKUYhXLXD2wvGqLv30n/W4um8EnKsh44iMBg== X-Received: by 2002:a05:600c:3c96:b0:426:6eae:6596 with SMTP id 5b1f17b1804b1-429dd264983mr13645925e9.25.1723628400773; Wed, 14 Aug 2024 02:40:00 -0700 (PDT) Received: from krzk-bin.. ([178.197.215.209]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-429ded28cdasm14195615e9.16.2024.08.14.02.39.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Aug 2024 02:40:00 -0700 (PDT) From: Krzysztof Kozlowski To: Patrice Chotard , Thinh Nguyen , Greg Kroah-Hartman , Felipe Balbi , Peter Griffin , Giuseppe Cavallaro , Lee Jones , linux-arm-kernel@lists.infradead.org, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Krzysztof Kozlowski , stable@vger.kernel.org Subject: [PATCH 1/2] usb: dwc3: st: fix probed platform device ref count on probe error path Date: Wed, 14 Aug 2024 11:39:56 +0200 Message-ID: <20240814093957.37940-1-krzysztof.kozlowski@linaro.org> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240814_024003_272575_97EE364F X-CRM114-Status: GOOD ( 13.04 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The probe function never performs any paltform device allocation, thus error path "undo_platform_dev_alloc" is entirely bogus. It drops the reference count from the platform device being probed. If error path is triggered, this will lead to unbalanced device reference counts and premature release of device resources, thus possible use-after-free when releasing remaining devm-managed resources. Fixes: f83fca0707c6 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC") Cc: Signed-off-by: Krzysztof Kozlowski Reviewed-by: Patrice Chotard Acked-by: Thinh Nguyen --- drivers/usb/dwc3/dwc3-st.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/drivers/usb/dwc3/dwc3-st.c b/drivers/usb/dwc3/dwc3-st.c index 211360eee95a..a9cb04043f08 100644 --- a/drivers/usb/dwc3/dwc3-st.c +++ b/drivers/usb/dwc3/dwc3-st.c @@ -219,10 +219,8 @@ static int st_dwc3_probe(struct platform_device *pdev) dwc3_data->regmap = regmap; res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "syscfg-reg"); - if (!res) { - ret = -ENXIO; - goto undo_platform_dev_alloc; - } + if (!res) + return -ENXIO; dwc3_data->syscfg_reg_off = res->start; @@ -233,8 +231,7 @@ static int st_dwc3_probe(struct platform_device *pdev) devm_reset_control_get_exclusive(dev, "powerdown"); if (IS_ERR(dwc3_data->rstc_pwrdn)) { dev_err(&pdev->dev, "could not get power controller\n"); - ret = PTR_ERR(dwc3_data->rstc_pwrdn); - goto undo_platform_dev_alloc; + return PTR_ERR(dwc3_data->rstc_pwrdn); } /* Manage PowerDown */ @@ -300,8 +297,6 @@ static int st_dwc3_probe(struct platform_device *pdev) reset_control_assert(dwc3_data->rstc_rst); undo_powerdown: reset_control_assert(dwc3_data->rstc_pwrdn); -undo_platform_dev_alloc: - platform_device_put(pdev); return ret; }