[PATCH] bcma: propagate bcma_register_devices() error to host probe

[PATCH] bcma: propagate bcma_register_devices() error to host probe

[Haotian Zhang]

bcma_bus_register() ignores the return value of bcma_register_devices(),
which reports a failure when bcma_gpio_init() cannot register the GPIO
chip. The error is silently discarded, so the bus is registered anyway
and the host device stays bound with the bus half-initialized.
On device removal bcma_bus_unregister() unconditionally calls
gpiochip_remove() on a chip whose gpio_device was never registered,
the failure paths of gpiochip_add_data() free it but leave chip->gpiodev
dangling, and gpiochip_remove() dereferences it without any check,
causing a NULL pointer dereference or use-after-free.

Fix it by checking the return value of bcma_register_devices() in
bcma_bus_register() and propagating the error to the caller, so the host
probe fails instead of leaving the device bound in a half-initialized
state. This new failure exit can be taken after some cores were already
registered, so make the SoC host probe failure path unregister them, as
the PCI host already does.

Fixes: cf0936b06d8e ("bcma: add GPIO driver")
Cc: stable@vger.kernel.org
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
---
 drivers/bcma/host_soc.c | 1 +
 drivers/bcma/main.c     | 5 +++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/bcma/host_soc.c b/drivers/bcma/host_soc.c
index 20b1816c570b..0bec0d005b89 100644
--- a/drivers/bcma/host_soc.c
+++ b/drivers/bcma/host_soc.c
@@ -236,6 +236,7 @@ static int bcma_host_soc_probe(struct platform_device *pdev)
 	return err;
 
 err_unmap_mmio:
+	bcma_unregister_cores(bus);
 	iounmap(bus->mmio);
 	return err;
 }
diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
index 72f045e6ed51..55d17546c797 100644
--- a/drivers/bcma/main.c
+++ b/drivers/bcma/main.c
@@ -477,8 +477,9 @@ int bcma_bus_register(struct bcma_bus *bus)
 	}
 
 	/* Register found cores */
-	bcma_register_devices(bus);
-
+	err = bcma_register_devices(bus);
+	if (err)
+		return err;
 	bcma_info(bus, "Bus registered\n");
 
 	return 0;
-- 
2.43.0