From: Greg Kroah-Hartman Date: Tue, 12 May 2026 12:34:19 +0000 (+0200) Subject: 5.10-stable patches X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c81a6c7e5c9634d333c2d9266f3eda5abdeb1b15;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: alsa-firewire-tascam-do-not-drop-unread-control-events.patch alsa-usb-audio-avoid-potential-endless-loop-in-convert_chmap_v3.patch alsa-usb-audio-fix-uac3-cluster-descriptor-size-check.patch usb-omap_udc-dma-don-t-enable-burst-4-mode.patch usb-serial-option-add-telit-cinterion-le910cx-compositions.patch usb-ulpi-fix-memory-leak-on-ulpi_register-error-paths.patch --- diff --git a/queue-5.10/alsa-firewire-tascam-do-not-drop-unread-control-events.patch b/queue-5.10/alsa-firewire-tascam-do-not-drop-unread-control-events.patch new file mode 100644 index 0000000000..b2bd0f8717 --- /dev/null +++ b/queue-5.10/alsa-firewire-tascam-do-not-drop-unread-control-events.patch @@ -0,0 +1,50 @@ +From 0749daa8eb5ab90334aaad3b0671efd7150d43b1 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= +Date: Sun, 3 May 2026 21:55:52 -0300 +Subject: ALSA: firewire-tascam: Do not drop unread control events +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cássio Gabriel + +commit 0749daa8eb5ab90334aaad3b0671efd7150d43b1 upstream. + +tscm_hwdep_read_queue() copies as many queued control events as fit in +the userspace buffer. When the buffer is smaller than the current +contiguous queue segment, length is rounded down to the number of bytes +that can be copied. + +However, after copying that shortened length, the code advances pull_pos +to the original tail_pos, marking the whole contiguous segment as +consumed. Any events between the copied portion and tail_pos are lost. + +Limit tail_pos to the position after the entries actually copied before +updating pull_pos. When the whole segment fits, this is equivalent to the +old tail_pos update; when the buffer is smaller, the remaining events +stay queued for the next read. + +Fixes: a8c0d13267a4 ("ALSA: firewire-tascam: notify events of change of state for userspace applications") +Cc: stable@vger.kernel.org +Suggested-by: Takashi Sakamoto +Signed-off-by: Cássio Gabriel +Reviewed-by: Takashi Sakamoto +Co-developed-by: Takashi Sakamoto +Signed-off-by: Takashi Sakamoto +Signed-off-by: Takashi Iwai +Link: https://patch.msgid.link/20260503-alsa-firewire-tascam-read-queue-v2-1-126c6efd7642@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + sound/firewire/tascam/tascam-hwdep.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/firewire/tascam/tascam-hwdep.c ++++ b/sound/firewire/tascam/tascam-hwdep.c +@@ -73,6 +73,7 @@ static long tscm_hwdep_read_queue(struct + length = rounddown(remained, sizeof(*entries)); + if (length == 0) + break; ++ tail_pos = head_pos + length / sizeof(*entries); + + spin_unlock_irq(&tscm->lock); + if (copy_to_user(pos, &entries[head_pos], length)) diff --git a/queue-5.10/alsa-usb-audio-avoid-potential-endless-loop-in-convert_chmap_v3.patch b/queue-5.10/alsa-usb-audio-avoid-potential-endless-loop-in-convert_chmap_v3.patch new file mode 100644 index 0000000000..888cdd2d94 --- /dev/null +++ b/queue-5.10/alsa-usb-audio-avoid-potential-endless-loop-in-convert_chmap_v3.patch @@ -0,0 +1,35 @@ +From 6e7247d8f5fefeceb0bb9cc80a5388a636b219cd Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 27 Apr 2026 17:22:15 +0200 +Subject: ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() + +From: Takashi Iwai + +commit 6e7247d8f5fefeceb0bb9cc80a5388a636b219cd upstream. + +The convert_chmap_v3() has a loop with its increment size of +cs_desc->wLength, but we forgot to validate cs_desc->wLength itself, +which may lead to potential endless loop by a malformed descriptor. + +Add a proper size check to abort the loop for plugging the hole. + +Fixes: ecfd41166b72 ("ALSA: usb-audio: Validate UAC3 cluster segment descriptors") +Cc: +Link: https://patch.msgid.link/20260427152224.15276-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/stream.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/usb/stream.c ++++ b/sound/usb/stream.c +@@ -353,6 +353,8 @@ snd_pcm_chmap_elem *convert_chmap_v3(str + if (len < sizeof(*cs_desc)) + break; + cs_len = le16_to_cpu(cs_desc->wLength); ++ if (cs_len < sizeof(*cs_desc)) ++ break; + if (len < cs_len) + break; + cs_type = cs_desc->bSegmentType; diff --git a/queue-5.10/alsa-usb-audio-fix-uac3-cluster-descriptor-size-check.patch b/queue-5.10/alsa-usb-audio-fix-uac3-cluster-descriptor-size-check.patch new file mode 100644 index 0000000000..9d1ba6d51f --- /dev/null +++ b/queue-5.10/alsa-usb-audio-fix-uac3-cluster-descriptor-size-check.patch @@ -0,0 +1,46 @@ +From 26265dd69da32d88a88d21987853cec899d9e21f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= +Date: Fri, 24 Apr 2026 18:50:10 -0300 +Subject: ALSA: usb-audio: Fix UAC3 cluster descriptor size check +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cássio Gabriel + +commit 26265dd69da32d88a88d21987853cec899d9e21f upstream. + +The UAC3 cluster descriptor length check in +snd_usb_get_audioformat_uac3()was added to +make sure that the buffer is large enough for +a struct uac3_cluster_header_descriptor before the +returned data is cast and used. + +However, the check uses sizeof(cluster), where cluster +is a pointer, not the size of the descriptor header. +This makes the validation depend on the architecture +pointer size and does not match the intended object size. + +Check against sizeof(*cluster) instead. + +Fixes: fb4e2a6e8f28 ("ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()") +Cc: stable@vger.kernel.org +Signed-off-by: Cássio Gabriel +Link: https://patch.msgid.link/20260424-alsa-usb-uac3-cluster-size-v1-1-99a5808898a3@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/stream.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/usb/stream.c ++++ b/sound/usb/stream.c +@@ -994,7 +994,7 @@ snd_usb_get_audioformat_uac3(struct snd_ + * and request Cluster Descriptor + */ + wLength = le16_to_cpu(hc_header.wLength); +- if (wLength < sizeof(cluster)) ++ if (wLength < sizeof(*cluster)) + return NULL; + cluster = kzalloc(wLength, GFP_KERNEL); + if (!cluster) diff --git a/queue-5.10/series b/queue-5.10/series index 69b269c33d..4362d72dd8 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -227,3 +227,9 @@ wifi-ath5k-do-not-access-array-oob.patch wifi-b43-enforce-bounds-check-on-firmware-key-index-in-b43_rx.patch usb-usblp-fix-heap-leak-in-ieee-1284-device-id-via-short-response.patch usb-usblp-fix-uninitialized-heap-leak-via-lpgetstatus-ioctl.patch +alsa-usb-audio-avoid-potential-endless-loop-in-convert_chmap_v3.patch +alsa-usb-audio-fix-uac3-cluster-descriptor-size-check.patch +usb-omap_udc-dma-don-t-enable-burst-4-mode.patch +usb-serial-option-add-telit-cinterion-le910cx-compositions.patch +usb-ulpi-fix-memory-leak-on-ulpi_register-error-paths.patch +alsa-firewire-tascam-do-not-drop-unread-control-events.patch diff --git a/queue-5.10/usb-omap_udc-dma-don-t-enable-burst-4-mode.patch b/queue-5.10/usb-omap_udc-dma-don-t-enable-burst-4-mode.patch new file mode 100644 index 0000000000..a25c02353c --- /dev/null +++ b/queue-5.10/usb-omap_udc-dma-don-t-enable-burst-4-mode.patch @@ -0,0 +1,60 @@ +From 3f91484f6c13c434bd573ca6b6779c26adb0ddab Mon Sep 17 00:00:00 2001 +From: Aaro Koskinen +Date: Mon, 13 Apr 2026 21:49:12 +0300 +Subject: USB: omap_udc: DMA: Don't enable burst 4 mode + +From: Aaro Koskinen + +commit 3f91484f6c13c434bd573ca6b6779c26adb0ddab upstream. + +Commit 65111084c63d7 ("USB: more omap_udc updates (dma and omap1710)") +added setting for DMA burst 4 mode. But I think this should be undone for +two reasons: + +- It breaks DMA on 15xx boards - transfers just silently stall. + +- On newer OMAP1 boards, like Nokia 770 (omap1710), there is no measurable +performance impact when testing TCP throughput with g_ether with large +15000 byte MTU size. + +It's also worth noting that when the original change was made, the +OMAP_DMA_DATA_BURST_4 handling in arch/arm/plat-omap/dma.c was broken, and +actually resulted in the same as the OMAP_DMA_DATA_BURST_DIS i.e. burst +disabled. This was fixed not until a couple kernel releases later in an +unrelated commit 1a8bfa1eb998a ("[ARM] 3142/1: OMAP 2/5: Update files +common to omap1 and omap2"). + +So based on this it seems there was never really a very good reason to +enable this burst mode in omap_udc, so remove it now to allow 15xx DMA +to work again (it provides 2x throughput compared to PIO mode). + +Fixes: 65111084c63d ("[PATCH] USB: more omap_udc updates (dma and omap1710)") +Cc: stable +Signed-off-by: Aaro Koskinen +Link: https://patch.msgid.link/ad06qHLclWHeSGnV@darkstar.musicnaut.iki.fi +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/omap_udc.c | 4 ---- + 1 file changed, 4 deletions(-) + +--- a/drivers/usb/gadget/udc/omap_udc.c ++++ b/drivers/usb/gadget/udc/omap_udc.c +@@ -731,8 +731,6 @@ static void dma_channel_claim(struct oma + if (status == 0) { + omap_writew(reg, UDC_TXDMA_CFG); + /* EMIFF or SDRC */ +- omap_set_dma_src_burst_mode(ep->lch, +- OMAP_DMA_DATA_BURST_4); + omap_set_dma_src_data_pack(ep->lch, 1); + /* TIPB */ + omap_set_dma_dest_params(ep->lch, +@@ -754,8 +752,6 @@ static void dma_channel_claim(struct oma + UDC_DATA_DMA, + 0, 0); + /* EMIFF or SDRC */ +- omap_set_dma_dest_burst_mode(ep->lch, +- OMAP_DMA_DATA_BURST_4); + omap_set_dma_dest_data_pack(ep->lch, 1); + } + } diff --git a/queue-5.10/usb-serial-option-add-telit-cinterion-le910cx-compositions.patch b/queue-5.10/usb-serial-option-add-telit-cinterion-le910cx-compositions.patch new file mode 100644 index 0000000000..4c59ad60c3 --- /dev/null +++ b/queue-5.10/usb-serial-option-add-telit-cinterion-le910cx-compositions.patch @@ -0,0 +1,135 @@ +From 100201d349edd226ca3470c894c92dccc67ee7a8 Mon Sep 17 00:00:00 2001 +From: Fabio Porcedda +Date: Mon, 27 Apr 2026 11:17:46 +0200 +Subject: USB: serial: option: add Telit Cinterion LE910Cx compositions + +From: Fabio Porcedda + +commit 100201d349edd226ca3470c894c92dccc67ee7a8 upstream. + +Add the following Telit Cinterion LE910Cx compositions: + +0x1251: RNDIS + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (SAP) +T: Bus=01 Lev=01 Prnt=21 Port=06 Cnt=01 Dev#=108 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=1251 Rev=03.18 +S: Manufacturer=Android +S: Product=LE910C1-EU +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=02 Prot=ff Driver=rndis_host +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms + +0x1253: ECM + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (SAP) +T: Bus=01 Lev=01 Prnt=21 Port=06 Cnt=01 Dev#=121 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=1253 Rev=03.18 +S: Manufacturer=Android +S: Product=LE910C1-EU +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms + +0x1254: tty (AT) + tty (AT) +T: Bus=01 Lev=01 Prnt=21 Port=06 Cnt=01 Dev#=122 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=1254 Rev=03.18 +S: Manufacturer=Android +S: Product=LE910C1-EU +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 2 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms + +0x1255: tty (AT/NMEA) + tty (AT) + tty (AT) + tty (SAP) +T: Bus=01 Lev=01 Prnt=21 Port=06 Cnt=01 Dev#=123 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=1255 Rev=03.18 +S: Manufacturer=Android +S: Product=LE910C1-EU +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms + +Cc: stable@vger.kernel.org +Signed-off-by: Fabio Porcedda +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1513,7 +1513,11 @@ static const struct usb_device_id option + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1231, 0xff), /* Telit LE910Cx (RNDIS) */ + .driver_info = NCTRL(2) | RSVD(3) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x1250, 0xff, 0x00, 0x00) }, /* Telit LE910Cx (rmnet) */ ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1251, 0xff) }, /* Telit LE910Cx (RNDIS) */ + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1252, 0xff) }, /* Telit LE910Cx (MBIM) */ ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1253, 0xff) }, /* Telit LE910Cx (ECM) */ ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1254, 0xff) }, /* Telit LE910Cx */ ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1255, 0xff) }, /* Telit LE910Cx */ + { USB_DEVICE(TELIT_VENDOR_ID, 0x1260), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, + { USB_DEVICE(TELIT_VENDOR_ID, 0x1261), diff --git a/queue-5.10/usb-ulpi-fix-memory-leak-on-ulpi_register-error-paths.patch b/queue-5.10/usb-ulpi-fix-memory-leak-on-ulpi_register-error-paths.patch new file mode 100644 index 0000000000..f04991a5b4 --- /dev/null +++ b/queue-5.10/usb-ulpi-fix-memory-leak-on-ulpi_register-error-paths.patch @@ -0,0 +1,48 @@ +From 0b9fcab1b8608d429e5f239afb197de928d4de7d Mon Sep 17 00:00:00 2001 +From: Felix Gu +Date: Tue, 7 Apr 2026 21:21:22 +0800 +Subject: usb: ulpi: fix memory leak on ulpi_register() error paths + +From: Felix Gu + +commit 0b9fcab1b8608d429e5f239afb197de928d4de7d upstream. + +Commit 01af542392b5 ("usb: ulpi: fix double free in +ulpi_register_interface() error path") removed kfree(ulpi) from +ulpi_register_interface() to fix a double-free when device_register() +fails. + +But when ulpi_of_register() or ulpi_read_id() fail before +device_register() is called, the ulpi allocation is leaked. + +Add kfree(ulpi) on both error paths to properly clean up the allocation. + +Fixes: 01af542392b5 ("usb: ulpi: fix double free in ulpi_register_interface() error path") +Cc: stable +Signed-off-by: Felix Gu +Reviewed-by: Heikki Krogerus +Link: https://patch.msgid.link/20260407-ulpi-v1-1-f3fafe53f7b2@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/common/ulpi.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/usb/common/ulpi.c ++++ b/drivers/usb/common/ulpi.c +@@ -246,12 +246,15 @@ static int ulpi_register(struct device * + ACPI_COMPANION_SET(&ulpi->dev, ACPI_COMPANION(dev)); + + ret = ulpi_of_register(ulpi); +- if (ret) ++ if (ret) { ++ kfree(ulpi); + return ret; ++ } + + ret = ulpi_read_id(ulpi); + if (ret) { + of_node_put(ulpi->dev.of_node); ++ kfree(ulpi); + return ret; + } +