linux-kernel - [PATCH v2 2/2] most: usb: hdm_probe: fix calling put_device() before device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20251021131625.2707245-2-Victoria.Votokina@kaspersky.com>
Date: Tue, 21 Oct 2025 16:16:25 +0300
From: Victoria Votokina <Victoria.Votokina@...persky.com>
To: Parthiban Veerasooran <parthiban.veerasooran@...rochip.com>
CC: Victoria Votokina <Victoria.Votokina@...persky.com>, Christian Gromm
	<christian.gromm@...rochip.com>, Greg Kroah-Hartman
	<gregkh@...uxfoundation.org>, <linux-kernel@...r.kernel.org>,
	<lvc-project@...uxtesting.org>, <Oleg.Kazakov@...persky.com>
Subject: [PATCH v2 2/2] most: usb: hdm_probe: fix calling put_device() before device_initialize()

Early failures in hdm_probe() could jump to err_free_mdev before 
&mdev->dev was initialized with device_initialize(), which triggered 
a device core WARN and kref_put() on an uninitialized kobject. 
Free the private struct directly in this pre-initialization path.

While here, replace a few unnecessary goto-based unwinds with 
direct returns and drop the now-unused err_free_dci label. On
device_register() failure, call put_device(&mdev->dci->dev) 
before returning to keep the reference model correct.

This removes the WARNING and simplifies the error paths 
without changing the success path behavior.


Fixes: 97a6f772f36b ("drivers: most: add USB adapter driver")
Signed-off-by: Victoria Votokina <Victoria.Votokina@...persky.com>
---
v2: Fixed error path for initialized interfaces requiring 
    most_deregister_interface

 drivers/most/most_usb.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/drivers/most/most_usb.c b/drivers/most/most_usb.c
index 3d8163bb7b46d..9d0a62023551c 100644
--- a/drivers/most/most_usb.c
+++ b/drivers/most/most_usb.c
@@ -1068,8 +1068,7 @@ hdm_probe(struct usb_interface *interface, const struct usb_device_id *id)
 		if (!mdev->dci) {
 			mutex_unlock(&mdev->io_mutex);
 			most_deregister_interface(&mdev->iface);
-			ret = -ENOMEM;
-			goto err_free_busy_urbs;
+			return -ENOMEM;
 		}
 
 		mdev->dci->dev.init_name = "dci";
@@ -1078,16 +1077,14 @@ hdm_probe(struct usb_interface *interface, const struct usb_device_id *id)
 		mdev->dci->dev.release = release_dci;
 		if (device_register(&mdev->dci->dev)) {
 			mutex_unlock(&mdev->io_mutex);
+			put_device(&mdev->dci->dev);
 			most_deregister_interface(&mdev->iface);
-			ret = -ENOMEM;
-			goto err_free_dci;
+			return -ENOMEM;
 		}
 		mdev->dci->usb_device = mdev->usb_device;
 	}
 	mutex_unlock(&mdev->io_mutex);
 	return 0;
-err_free_dci:
-	put_device(&mdev->dci->dev);
 err_free_busy_urbs:
 	kfree(mdev->busy_urbs);
 err_free_ep_address:
@@ -1097,7 +1094,7 @@ hdm_probe(struct usb_interface *interface, const struct usb_device_id *id)
 err_free_conf:
 	kfree(mdev->conf);
 err_free_mdev:
-	put_device(&mdev->dev);
+	kfree(mdev);
 	return ret;
 }
 
-- 
2.30.2