linux-kernel - Re: [PATCH v2 2/5] usb: phy: isp1301: fix non-OF device reference imbalance

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <71adaa7f-808a-47df-85ed-55ec12da4561@mleia.com>
Date: Fri, 19 Dec 2025 02:15:12 +0200
From: Vladimir Zapolskiy <vz@...ia.com>
To: Johan Hovold <johan@...nel.org>,
 Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: Piotr Wojtaszczyk <piotr.wojtaszczyk@...esys.com>,
 Alan Stern <stern@...land.harvard.edu>, Ma Ke <make24@...as.ac.cn>,
 linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
 stable@...r.kernel.org
Subject: Re: [PATCH v2 2/5] usb: phy: isp1301: fix non-OF device reference
 imbalance

On 12/18/25 17:35, Johan Hovold wrote:
> A recent change fixing a device reference leak in a UDC driver
> introduced a potential use-after-free in the non-OF case as the
> isp1301_get_client() helper only increases the reference count for the
> returned I2C device in the OF case.

Fortunatly there is no non-OF users of this driver, it's been discussed
recently.

> 
> Increment the reference count also for non-OF so that the caller can
> decrement it unconditionally.
> 
> Note that this is inherently racy just as using the returned I2C device
> is since nothing is preventing the PHY driver from being unbound while
> in use.
> 
> Fixes: c84117912bdd ("USB: lpc32xx_udc: Fix error handling in probe")
> Cc: stable@...r.kernel.org
> Cc: Ma Ke <make24@...as.ac.cn>
> Signed-off-by: Johan Hovold <johan@...nel.org>
> ---
>   drivers/usb/phy/phy-isp1301.c | 7 ++++++-
>   1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/phy/phy-isp1301.c b/drivers/usb/phy/phy-isp1301.c
> index f9b5c411aee4..2940f0c84e1b 100644
> --- a/drivers/usb/phy/phy-isp1301.c
> +++ b/drivers/usb/phy/phy-isp1301.c
> @@ -149,7 +149,12 @@ struct i2c_client *isp1301_get_client(struct device_node *node)
>   		return client;
>   
>   	/* non-DT: only one ISP1301 chip supported */
> -	return isp1301_i2c_client;
> +	if (isp1301_i2c_client) {
> +		get_device(&isp1301_i2c_client->dev);
> +		return isp1301_i2c_client;
> +	}
> +
> +	return NULL;
>   }
>   EXPORT_SYMBOL_GPL(isp1301_get_client);
>   

Okay, let's go the way of fixing the broken commit instead of its reversal.

Reviewed-by: Vladimir Zapolskiy <vz@...ia.com>

-- 
Best wishes,
Vladimir