[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20191216174832.699676929@linuxfoundation.org>
Date: Mon, 16 Dec 2019 18:48:40 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-kernel@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
stable@...r.kernel.org, Wen Yang <wenyang@...ux.alibaba.com>,
linux-usb@...r.kernel.org,
Heikki Krogerus
<heikki.krogerus@...ux.intel.com>
Subject: [PATCH 5.4 064/177] usb: typec: fix use after free in typec_register_port()
From: Wen Yang <wenyang@...ux.alibaba.com>
commit 5c388abefda0d92355714010c0199055c57ab6c7 upstream.
We can't use "port->sw" and/or "port->mux" after it has been freed.
Fixes: 23481121c81d ("usb: typec: class: Don't use port parent for getting mux handles")
Signed-off-by: Wen Yang <wenyang@...ux.alibaba.com>
Cc: stable <stable@...r.kernel.org>
Cc: linux-usb@...r.kernel.org
Cc: linux-kernel@...r.kernel.org
Acked-by: Heikki Krogerus <heikki.krogerus@...ux.intel.com>
Link: https://lore.kernel.org/r/20191126140452.14048-1-wenyang@linux.alibaba.com
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
---
drivers/usb/typec/class.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/usb/typec/class.c
+++ b/drivers/usb/typec/class.c
@@ -1592,14 +1592,16 @@ struct typec_port *typec_register_port(s
port->sw = typec_switch_get(&port->dev);
if (IS_ERR(port->sw)) {
+ ret = PTR_ERR(port->sw);
put_device(&port->dev);
- return ERR_CAST(port->sw);
+ return ERR_PTR(ret);
}
port->mux = typec_mux_get(&port->dev, NULL);
if (IS_ERR(port->mux)) {
+ ret = PTR_ERR(port->mux);
put_device(&port->dev);
- return ERR_CAST(port->mux);
+ return ERR_PTR(ret);
}
ret = device_add(&port->dev);
Powered by blists - more mailing lists