From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 51D6F44C97; Sun, 1 Sep 2024 16:28:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725208121; cv=none; b=T+5cVkWokY9mzHnAl8KoLwuKywD2DXsoGhZBDNe7i3QI4dyN0lvHltVSn0yXPd+9+Go9QY6WbTffpR6c/n9UBw2fz0R+7/XvrDi3/mnDjo0VTU2uV1aU1CnGnNWKPaKeqL07VDh6Fv2lgQlO3xghBRWN1ZJjVt6vXIVbxKLnEjc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725208121; c=relaxed/simple; bh=pI93jKb0iF2l8zRrHFTwhtM6V0EnjL/5bJ89etHET+c=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=bTnvByfgFuPi0kwAB2ex+4j8ukmdUd2IOyn+S2UmSLimAGfpV9TAYdtK9GMDTd2zflOtXADborMKPT/P+4dGFIREluBapXbue65gks3zZaZ1Aimd1XA7W6yt0NZ5lRSq8WT22n4dDUjbo0adKolHerg05tmCxl56ckdN/uB7rwE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=lEV71fGh; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="lEV71fGh" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C5DACC4CEC3; Sun, 1 Sep 2024 16:28:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1725208121; bh=pI93jKb0iF2l8zRrHFTwhtM6V0EnjL/5bJ89etHET+c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lEV71fGhLWES7128eAW8QJ/Jw9h9I6P6zvlk/MxvqIQvOIM5PxpwyFGpmzDRhXiiN 3r3JPA20DWxzPoEQyBJVAS+Bwn/93ZSH8knyYIm09eWqn/D9m+wbfpEVpqf1SYZ4ew y2leUdNcgQcvERP7wb/HN8Xz4JZ09dQGEJhjsYQ4= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Krzysztof Kozlowski , Thinh Nguyen , Patrice Chotard Subject: [PATCH 6.6 80/93] usb: dwc3: st: fix probed platform device ref count on probe error path Date: Sun, 1 Sep 2024 18:17:07 +0200 Message-ID: <20240901160810.746507039@linuxfoundation.org> X-Mailer: git-send-email 2.46.0 In-Reply-To: <20240901160807.346406833@linuxfoundation.org> References: <20240901160807.346406833@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Krzysztof Kozlowski commit ddfcfeba891064b88bb844208b43bef2ef970f0c upstream. The probe function never performs any paltform device allocation, thus error path "undo_platform_dev_alloc" is entirely bogus. It drops the reference count from the platform device being probed. If error path is triggered, this will lead to unbalanced device reference counts and premature release of device resources, thus possible use-after-free when releasing remaining devm-managed resources. Fixes: f83fca0707c6 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Acked-by: Thinh Nguyen Reviewed-by: Patrice Chotard Link: https://lore.kernel.org/r/20240814093957.37940-1-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman --- drivers/usb/dwc3/dwc3-st.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) --- a/drivers/usb/dwc3/dwc3-st.c +++ b/drivers/usb/dwc3/dwc3-st.c @@ -219,10 +219,8 @@ static int st_dwc3_probe(struct platform dwc3_data->regmap = regmap; res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "syscfg-reg"); - if (!res) { - ret = -ENXIO; - goto undo_platform_dev_alloc; - } + if (!res) + return -ENXIO; dwc3_data->syscfg_reg_off = res->start; @@ -233,8 +231,7 @@ static int st_dwc3_probe(struct platform devm_reset_control_get_exclusive(dev, "powerdown"); if (IS_ERR(dwc3_data->rstc_pwrdn)) { dev_err(&pdev->dev, "could not get power controller\n"); - ret = PTR_ERR(dwc3_data->rstc_pwrdn); - goto undo_platform_dev_alloc; + return PTR_ERR(dwc3_data->rstc_pwrdn); } /* Manage PowerDown */ @@ -300,8 +297,6 @@ undo_softreset: reset_control_assert(dwc3_data->rstc_rst); undo_powerdown: reset_control_assert(dwc3_data->rstc_pwrdn); -undo_platform_dev_alloc: - platform_device_put(pdev); return ret; }