]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug
authorChenyuan Yang <chenyuan0y@gmail.com>
Mon, 14 Apr 2025 12:50:50 +0000 (07:50 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 27 Jun 2025 10:07:16 +0000 (11:07 +0100)
commit0b979a409e40457ca1b5cb48755d1f34eee58805
treef00569ac597c959aa237d44e299d32d12b260025
parent4798c86831a29ae46d6e833fa7c272b335806648
phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug

[ Upstream commit d14402a38c2d868cacb1facaf9be908ca6558e59 ]

The qmp_usb_iomap() helper function currently returns the raw result of
devm_ioremap() for non-exclusive mappings. Since devm_ioremap() may return
a NULL pointer and the caller only checks error pointers with IS_ERR(),
NULL could bypass the check and lead to an invalid dereference.

Fix the issue by checking if devm_ioremap() returns NULL. When it does,
qmp_usb_iomap() now returns an error pointer via IOMEM_ERR_PTR(-ENOMEM),
ensuring safe and consistent error handling.

Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com>
Fixes: a5d6b1ac56cb ("phy: qcom-qmp-usb: fix memleak on probe deferral")
CC: Johan Hovold <johan@kernel.org>
CC: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250414125050.2118619-1-chenyuan0y@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/phy/qualcomm/phy-qcom-qmp-usb.c