From: Yongzhi Liu <hyperlyzcs@gmail.com>
To: wentong.wu@intel.com, gregkh@linuxfoundation.org,
hdegoede@redhat.com, andi.shyti@linux.intel.com
Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
jitxie@tencent.com, huntazhang@tencent.com,
Yongzhi Liu <hyperlyzcs@gmail.com>
Subject: [PATCH] usb: misc: ljca: Fix double free in error handling path
Date: Wed, 6 Mar 2024 21:00:42 +0800 [thread overview]
Message-ID: <20240306130042.26811-1-hyperlyzcs@gmail.com> (raw)
When auxiliary_device_add() returns error and then calls
auxiliary_device_uninit(), callback function ljca_auxdev_release
calls kfree(auxdev->dev.platform_data) to free the parameter data
of the function ljca_new_client_device. The callers of
ljca_new_client_device shouldn't call kfree() again
in the error handling path to free the platform data.
Fix this by cleaning up the redundant kfree().
Fixes: acd6199f195d ("usb: Add support for Intel LJCA device")
Signed-off-by: Yongzhi Liu <hyperlyzcs@gmail.com>
---
drivers/usb/misc/usb-ljca.c | 18 +++---------------
1 file changed, 3 insertions(+), 15 deletions(-)
diff --git a/drivers/usb/misc/usb-ljca.c b/drivers/usb/misc/usb-ljca.c
index 35770e608c64..be702364be08 100644
--- a/drivers/usb/misc/usb-ljca.c
+++ b/drivers/usb/misc/usb-ljca.c
@@ -590,12 +590,8 @@ static int ljca_enumerate_gpio(struct ljca_adapter *adap)
valid_pin[i] = get_unaligned_le32(&desc->bank_desc[i].valid_pins);
bitmap_from_arr32(gpio_info->valid_pin_map, valid_pin, gpio_num);
- ret = ljca_new_client_device(adap, LJCA_CLIENT_GPIO, 0, "ljca-gpio",
+ return ljca_new_client_device(adap, LJCA_CLIENT_GPIO, 0, "ljca-gpio",
gpio_info, LJCA_GPIO_ACPI_ADR);
- if (ret)
- kfree(gpio_info);
-
- return ret;
}
static int ljca_enumerate_i2c(struct ljca_adapter *adap)
@@ -626,13 +622,9 @@ static int ljca_enumerate_i2c(struct ljca_adapter *adap)
i2c_info->capacity = desc->info[i].capacity;
i2c_info->intr_pin = desc->info[i].intr_pin;
- ret = ljca_new_client_device(adap, LJCA_CLIENT_I2C, i,
+ return ljca_new_client_device(adap, LJCA_CLIENT_I2C, i,
"ljca-i2c", i2c_info,
LJCA_I2C1_ACPI_ADR + i);
- if (ret) {
- kfree(i2c_info);
- return ret;
- }
}
return 0;
@@ -666,13 +658,9 @@ static int ljca_enumerate_spi(struct ljca_adapter *adap)
spi_info->id = desc->info[i].id;
spi_info->capacity = desc->info[i].capacity;
- ret = ljca_new_client_device(adap, LJCA_CLIENT_SPI, i,
+ return ljca_new_client_device(adap, LJCA_CLIENT_SPI, i,
"ljca-spi", spi_info,
LJCA_SPI1_ACPI_ADR + i);
- if (ret) {
- kfree(spi_info);
- return ret;
- }
}
return 0;
--
2.36.1
next reply other threads:[~2024-03-06 13:00 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-06 13:00 Yongzhi Liu [this message]
2024-03-06 13:28 ` [PATCH] usb: misc: ljca: Fix double free in error handling path Hans de Goede
2024-03-07 11:57 ` [PATCH V2] " Yongzhi Liu
2024-03-10 11:46 ` Hans de Goede
2024-03-11 12:57 ` [PATCH V3] " Yongzhi Liu
2024-03-11 12:58 ` Hans de Goede
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240306130042.26811-1-hyperlyzcs@gmail.com \
--to=hyperlyzcs@gmail.com \
--cc=andi.shyti@linux.intel.com \
--cc=gregkh@linuxfoundation.org \
--cc=hdegoede@redhat.com \
--cc=huntazhang@tencent.com \
--cc=jitxie@tencent.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=wentong.wu@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).