git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From 74adad500346fb07d69af2c79acbff4adb061134 Mon Sep 17 00:00:00 2001
   2 From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
   3 Date: Mon, 16 Dec 2024 10:55:39 +0900
   4 Subject: usb: chipidea: ci_hdrc_imx: decrement device's refcount in .remove() and in the error path of .probe()
   5
   6 From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
   7
   8 commit 74adad500346fb07d69af2c79acbff4adb061134 upstream.
   9
  10 Current implementation of ci_hdrc_imx_driver does not decrement the
  11 refcount of the device obtained in usbmisc_get_init_data(). Add a
  12 put_device() call in .remove() and in .probe() before returning an
  13 error.
  14
  15 This bug was found by an experimental static analysis tool that I am
  16 developing.
  17
  18 Cc: stable <stable@kernel.org>
  19 Fixes: f40017e0f332 ("chipidea: usbmisc_imx: Add USB support for VF610 SoCs")
  20 Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
  21 Acked-by: Peter Chen <peter.chen@kernel.org>
  22 Link: https://lore.kernel.org/r/20241216015539.352579-1-joe@pf.is.s.u-tokyo.ac.jp
  23 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  24 ---
  25  drivers/usb/chipidea/ci_hdrc_imx.c |   25 +++++++++++++++++--------
  26  1 file changed, 17 insertions(+), 8 deletions(-)
  27
  28 --- a/drivers/usb/chipidea/ci_hdrc_imx.c
  29 +++ b/drivers/usb/chipidea/ci_hdrc_imx.c
  30 @@ -362,25 +362,29 @@ static int ci_hdrc_imx_probe(struct plat
  31                 data->pinctrl = devm_pinctrl_get(dev);
  32                 if (PTR_ERR(data->pinctrl) == -ENODEV)
  33                         data->pinctrl = NULL;
  34 -               else if (IS_ERR(data->pinctrl))
  35 -                       return dev_err_probe(dev, PTR_ERR(data->pinctrl),
  36 +               else if (IS_ERR(data->pinctrl)) {
  37 +                       ret = dev_err_probe(dev, PTR_ERR(data->pinctrl),
  38                                              "pinctrl get failed\n");
  39 +                       goto err_put;
  40 +               }
  41
  42                 data->hsic_pad_regulator =
  43                                 devm_regulator_get_optional(dev, "hsic");
  44                 if (PTR_ERR(data->hsic_pad_regulator) == -ENODEV) {
  45                         /* no pad regulator is needed */
  46                         data->hsic_pad_regulator = NULL;
  47 -               } else if (IS_ERR(data->hsic_pad_regulator))
  48 -                       return dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator),
  49 +               } else if (IS_ERR(data->hsic_pad_regulator)) {
  50 +                       ret = dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator),
  51                                              "Get HSIC pad regulator error\n");
  52 +                       goto err_put;
  53 +               }
  54
  55                 if (data->hsic_pad_regulator) {
  56                         ret = regulator_enable(data->hsic_pad_regulator);
  57                         if (ret) {
  58                                 dev_err(dev,
  59                                         "Failed to enable HSIC pad regulator\n");
  60 -                               return ret;
  61 +                               goto err_put;
  62                         }
  63                 }
  64         }
  65 @@ -394,13 +398,14 @@ static int ci_hdrc_imx_probe(struct plat
  66                         dev_err(dev,
  67                                 "pinctrl_hsic_idle lookup failed, err=%ld\n",
  68                                         PTR_ERR(pinctrl_hsic_idle));
  69 -                       return PTR_ERR(pinctrl_hsic_idle);
  70 +                       ret = PTR_ERR(pinctrl_hsic_idle);
  71 +                       goto err_put;
  72                 }
  73
  74                 ret = pinctrl_select_state(data->pinctrl, pinctrl_hsic_idle);
  75                 if (ret) {
  76                         dev_err(dev, "hsic_idle select failed, err=%d\n", ret);
  77 -                       return ret;
  78 +                       goto err_put;
  79                 }
  80
  81                 data->pinctrl_hsic_active = pinctrl_lookup_state(data->pinctrl,
  82 @@ -409,7 +414,8 @@ static int ci_hdrc_imx_probe(struct plat
  83                         dev_err(dev,
  84                                 "pinctrl_hsic_active lookup failed, err=%ld\n",
  85                                         PTR_ERR(data->pinctrl_hsic_active));
  86 -                       return PTR_ERR(data->pinctrl_hsic_active);
  87 +                       ret = PTR_ERR(data->pinctrl_hsic_active);
  88 +                       goto err_put;
  89                 }
  90         }
  91
  92 @@ -513,6 +519,8 @@ disable_hsic_regulator:
  93         if (pdata.flags & CI_HDRC_PMQOS)
  94                 cpu_latency_qos_remove_request(&data->pm_qos_req);
  95         data->ci_pdev = NULL;
  96 +err_put:
  97 +       put_device(data->usbmisc_data->dev);
  98         return ret;
  99  }
 100
 101 @@ -536,6 +544,7 @@ static void ci_hdrc_imx_remove(struct pl
 102                 if (data->hsic_pad_regulator)
 103                         regulator_disable(data->hsic_pad_regulator);
 104         }
 105 +       put_device(data->usbmisc_data->dev);
 106  }
 107
 108  static void ci_hdrc_imx_shutdown(struct platform_device *pdev)