From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0334F33987; Sun, 1 Sep 2024 16:24:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725207869; cv=none; b=l0fBW32tdEC3thHiprlzM2X1mOY+JrxWaOmWMSOTVFPgu9Iglq4/XBIqrQhxzqnzND2oOHGDiuVY2KHt61hpaCENg9BTZliOkmKlw5RNEguqzxGUxlzGXAwR6PM9SbZCoCOABRA4ECCaJ3kZmDaeEiyNNsnQ6+Aq3iJUbFFkqzg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725207869; c=relaxed/simple; bh=rdpttbXDPII9u9iCDKLXUC6psco/HORsxHCjQ65nLeQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=eceZ43NyPJcdRPumVbTkDRtO/Ce2j2iA5c/N4epTUvZv7sE2PdMpYNKLQXe8WY3duE6mBHX5RRBL9WXs5j0mLnH3Xbmn+VNq9J31pz2N38QZL0n4+RW7O1gRt2XKPt4f2oBcMMzvxmulWuE+MeYBHrDJAiP9r57E+CIYFu/I/CY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=b+IDvWYq; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="b+IDvWYq" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5D4CBC4CEC3; Sun, 1 Sep 2024 16:24:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1725207868; bh=rdpttbXDPII9u9iCDKLXUC6psco/HORsxHCjQ65nLeQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=b+IDvWYqPvUEOjWKfAvb8u5nUtcJ9pMR/QADB5UVZr4Jppf42yGh44lLxl6lC2Tcw i2QBewPwx1uEDsA+62EVn4iCyxjxlj8GlkPBBYsT+bKzBJ3irG9/FBlvPH4Jyts+0B Pav3pZUKwkIyUcim1PwOz8PAJbPQBMbm8vlp8X7g= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Krzysztof Kozlowski , Thinh Nguyen , Patrice Chotard Subject: [PATCH 4.19 94/98] usb: dwc3: st: fix probed platform device ref count on probe error path Date: Sun, 1 Sep 2024 18:17:04 +0200 Message-ID: <20240901160807.242506934@linuxfoundation.org> X-Mailer: git-send-email 2.46.0 In-Reply-To: <20240901160803.673617007@linuxfoundation.org> References: <20240901160803.673617007@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 4.19-stable review patch. If anyone has any objections, please let me know. ------------------ From: Krzysztof Kozlowski commit ddfcfeba891064b88bb844208b43bef2ef970f0c upstream. The probe function never performs any paltform device allocation, thus error path "undo_platform_dev_alloc" is entirely bogus. It drops the reference count from the platform device being probed. If error path is triggered, this will lead to unbalanced device reference counts and premature release of device resources, thus possible use-after-free when releasing remaining devm-managed resources. Fixes: f83fca0707c6 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Acked-by: Thinh Nguyen Reviewed-by: Patrice Chotard Link: https://lore.kernel.org/r/20240814093957.37940-1-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman --- drivers/usb/dwc3/dwc3-st.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) --- a/drivers/usb/dwc3/dwc3-st.c +++ b/drivers/usb/dwc3/dwc3-st.c @@ -219,10 +219,8 @@ static int st_dwc3_probe(struct platform dwc3_data->regmap = regmap; res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "syscfg-reg"); - if (!res) { - ret = -ENXIO; - goto undo_platform_dev_alloc; - } + if (!res) + return -ENXIO; dwc3_data->syscfg_reg_off = res->start; @@ -233,8 +231,7 @@ static int st_dwc3_probe(struct platform devm_reset_control_get_exclusive(dev, "powerdown"); if (IS_ERR(dwc3_data->rstc_pwrdn)) { dev_err(&pdev->dev, "could not get power controller\n"); - ret = PTR_ERR(dwc3_data->rstc_pwrdn); - goto undo_platform_dev_alloc; + return PTR_ERR(dwc3_data->rstc_pwrdn); } /* Manage PowerDown */ @@ -296,8 +293,6 @@ undo_softreset: reset_control_assert(dwc3_data->rstc_rst); undo_powerdown: reset_control_assert(dwc3_data->rstc_pwrdn); -undo_platform_dev_alloc: - platform_device_put(pdev); return ret; }