linux-usb.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Yongzhi Liu <hyperlyzcs@gmail.com>
To: wentong.wu@intel.com, gregkh@linuxfoundation.org,
	hdegoede@redhat.com, andi.shyti@linux.intel.com
Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
	jitxie@tencent.com, huntazhang@tencent.com,
	Yongzhi Liu <hyperlyzcs@gmail.com>
Subject: [PATCH] usb: misc: ljca: Fix double free in error handling path
Date: Wed,  6 Mar 2024 21:00:42 +0800	[thread overview]
Message-ID: <20240306130042.26811-1-hyperlyzcs@gmail.com> (raw)

When auxiliary_device_add() returns error and then calls
auxiliary_device_uninit(), callback function ljca_auxdev_release
calls kfree(auxdev->dev.platform_data) to free the parameter data
of the function ljca_new_client_device. The callers of
ljca_new_client_device shouldn't call kfree() again
in the error handling path to free the platform data.

Fix this by cleaning up the redundant kfree().

Fixes: acd6199f195d ("usb: Add support for Intel LJCA device")
Signed-off-by: Yongzhi Liu <hyperlyzcs@gmail.com>
---
 drivers/usb/misc/usb-ljca.c | 18 +++---------------
 1 file changed, 3 insertions(+), 15 deletions(-)

diff --git a/drivers/usb/misc/usb-ljca.c b/drivers/usb/misc/usb-ljca.c
index 35770e608c64..be702364be08 100644
--- a/drivers/usb/misc/usb-ljca.c
+++ b/drivers/usb/misc/usb-ljca.c
@@ -590,12 +590,8 @@ static int ljca_enumerate_gpio(struct ljca_adapter *adap)
 		valid_pin[i] = get_unaligned_le32(&desc->bank_desc[i].valid_pins);
 	bitmap_from_arr32(gpio_info->valid_pin_map, valid_pin, gpio_num);
 
-	ret = ljca_new_client_device(adap, LJCA_CLIENT_GPIO, 0, "ljca-gpio",
+	return ljca_new_client_device(adap, LJCA_CLIENT_GPIO, 0, "ljca-gpio",
 				     gpio_info, LJCA_GPIO_ACPI_ADR);
-	if (ret)
-		kfree(gpio_info);
-
-	return ret;
 }
 
 static int ljca_enumerate_i2c(struct ljca_adapter *adap)
@@ -626,13 +622,9 @@ static int ljca_enumerate_i2c(struct ljca_adapter *adap)
 		i2c_info->capacity = desc->info[i].capacity;
 		i2c_info->intr_pin = desc->info[i].intr_pin;
 
-		ret = ljca_new_client_device(adap, LJCA_CLIENT_I2C, i,
+		return ljca_new_client_device(adap, LJCA_CLIENT_I2C, i,
 					     "ljca-i2c", i2c_info,
 					     LJCA_I2C1_ACPI_ADR + i);
-		if (ret) {
-			kfree(i2c_info);
-			return ret;
-		}
 	}
 
 	return 0;
@@ -666,13 +658,9 @@ static int ljca_enumerate_spi(struct ljca_adapter *adap)
 		spi_info->id = desc->info[i].id;
 		spi_info->capacity = desc->info[i].capacity;
 
-		ret = ljca_new_client_device(adap, LJCA_CLIENT_SPI, i,
+		return ljca_new_client_device(adap, LJCA_CLIENT_SPI, i,
 					     "ljca-spi", spi_info,
 					     LJCA_SPI1_ACPI_ADR + i);
-		if (ret) {
-			kfree(spi_info);
-			return ret;
-		}
 	}
 
 	return 0;
-- 
2.36.1


             reply	other threads:[~2024-03-06 13:00 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-03-06 13:00 Yongzhi Liu [this message]
2024-03-06 13:28 ` [PATCH] usb: misc: ljca: Fix double free in error handling path Hans de Goede
2024-03-07 11:57   ` [PATCH V2] " Yongzhi Liu
2024-03-10 11:46     ` Hans de Goede
2024-03-11 12:57       ` [PATCH V3] " Yongzhi Liu
2024-03-11 12:58         ` Hans de Goede

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240306130042.26811-1-hyperlyzcs@gmail.com \
    --to=hyperlyzcs@gmail.com \
    --cc=andi.shyti@linux.intel.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=hdegoede@redhat.com \
    --cc=huntazhang@tencent.com \
    --cc=jitxie@tencent.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=wentong.wu@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).