[PATCH v2] USB: misc: uss720: unregister parport on probe failure

[PATCH v2] USB: misc: uss720: unregister parport on probe failure

[Myeonghun Pak]

uss720_probe() registers a parport before reading the 1284 register used
to detect unsupported Belkin F5U002 adapters. If get_1284_register()
fails, the error path drops the driver private data and the USB device
reference, but leaves the parport device registered.

Leaving the port registered is more than a private allocation leak:
parport_register_port() has already reserved a parport number and
registered the parport bus device, while pp->private_data still points at
the private data that the common error path is about to release.

Undo the pre-announce registration in the get_1284_register() failure
branch before jumping to the common private-data cleanup path. Clear
priv->pp first, matching the disconnect path and avoiding a stale pointer
in the private data.

This issue was identified during our ongoing static-analysis research while
reviewing kernel code.

Fixes: 3295f1b866bf ("usb: misc: uss720: check for incompatible versions of the Belkin F5U002")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
Changes in v2:
- Move the parport cleanup to the get_1284_register() failure branch,
  as suggested by Alex.
- Clarify the visible stale registered-port effect.

 drivers/usb/misc/uss720.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
index a8af7615b1..bd099cd8c5 100644
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -735,8 +735,11 @@ static int uss720_probe(struct usb_interface *intf,
 	 * here. */
 	ret = get_1284_register(pp, 0, &reg, GFP_KERNEL);
 	dev_dbg(&intf->dev, "reg: %7ph\n", priv->reg);
-	if (ret < 0)
+	if (ret < 0) {
+		priv->pp = NULL;
+		parport_del_port(pp);
 		goto probe_abort;
+	}
 
 	ret = usb_find_last_int_in_endpoint(interface, &epd);
 	if (!ret) {
-- 
2.47.1

Re: [PATCH v2] USB: misc: uss720: unregister parport on probe failure

[Alex Henrie]

On Mon, Jul 6, 2026 at 9:11 AM Myeonghun Pak <mhun512@gmail.com> wrote:
>
> uss720_probe() registers a parport before reading the 1284 register used
> to detect unsupported Belkin F5U002 adapters. If get_1284_register()
> fails, the error path drops the driver private data and the USB device
> reference, but leaves the parport device registered.
>
> Leaving the port registered is more than a private allocation leak:
> parport_register_port() has already reserved a parport number and
> registered the parport bus device, while pp->private_data still points at
> the private data that the common error path is about to release.
>
> Undo the pre-announce registration in the get_1284_register() failure
> branch before jumping to the common private-data cleanup path. Clear
> priv->pp first, matching the disconnect path and avoiding a stale pointer
> in the private data.
>
> This issue was identified during our ongoing static-analysis research while
> reviewing kernel code.
>
> Fixes: 3295f1b866bf ("usb: misc: uss720: check for incompatible versions of the Belkin F5U002")
> Cc: stable@vger.kernel.org
> Co-developed-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
> ---
> Changes in v2:
> - Move the parport cleanup to the get_1284_register() failure branch,
>   as suggested by Alex.
> - Clarify the visible stale registered-port effect.
>
>  drivers/usb/misc/uss720.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
> index a8af7615b1..bd099cd8c5 100644
> --- a/drivers/usb/misc/uss720.c
> +++ b/drivers/usb/misc/uss720.c
> @@ -735,8 +735,11 @@ static int uss720_probe(struct usb_interface *intf,
>          * here. */
>         ret = get_1284_register(pp, 0, &reg, GFP_KERNEL);
>         dev_dbg(&intf->dev, "reg: %7ph\n", priv->reg);
> -       if (ret < 0)
> +       if (ret < 0) {
> +               priv->pp = NULL;
> +               parport_del_port(pp);
>                 goto probe_abort;
> +       }
>
>         ret = usb_find_last_int_in_endpoint(interface, &epd);
>         if (!ret) {
> --
> 2.47.1

Reviewed-by: Alex Henrie <alexhenrie24@gmail.com>