| From 41b58feaa5376ab5cb32f537c14477c3b62da108 Mon Sep 17 00:00:00 2001 |
| From: Wen Yang <wenyang@linux.alibaba.com> |
| Date: Tue, 26 Nov 2019 22:04:52 +0800 |
| Subject: [PATCH] usb: typec: fix use after free in typec_register_port() |
| MIME-Version: 1.0 |
| Content-Type: text/plain; charset=UTF-8 |
| Content-Transfer-Encoding: 8bit |
| |
| commit 5c388abefda0d92355714010c0199055c57ab6c7 upstream. |
| |
| We can't use "port->sw" and/or "port->mux" after it has been freed. |
| |
| Fixes: 23481121c81d ("usb: typec: class: Don't use port parent for getting mux handles") |
| Signed-off-by: Wen Yang <wenyang@linux.alibaba.com> |
| Cc: stable <stable@vger.kernel.org> |
| Cc: linux-usb@vger.kernel.org |
| Cc: linux-kernel@vger.kernel.org |
| Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> |
| Link: https://lore.kernel.org/r/20191126140452.14048-1-wenyang@linux.alibaba.com |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c |
| index 2eb623841847..8eedbbb46289 100644 |
| --- a/drivers/usb/typec/class.c |
| +++ b/drivers/usb/typec/class.c |
| @@ -1604,14 +1604,16 @@ struct typec_port *typec_register_port(struct device *parent, |
| |
| port->sw = typec_switch_get(&port->dev); |
| if (IS_ERR(port->sw)) { |
| + ret = PTR_ERR(port->sw); |
| put_device(&port->dev); |
| - return ERR_CAST(port->sw); |
| + return ERR_PTR(ret); |
| } |
| |
| port->mux = typec_mux_get(&port->dev, NULL); |
| if (IS_ERR(port->mux)) { |
| + ret = PTR_ERR(port->mux); |
| put_device(&port->dev); |
| - return ERR_CAST(port->mux); |
| + return ERR_PTR(ret); |
| } |
| |
| ret = device_add(&port->dev); |
| -- |
| 2.7.4 |
| |
