Skip to content

Commit ddfcfeb

Browse files
krzkgregkh
authored andcommitted
usb: dwc3: st: fix probed platform device ref count on probe error path
The probe function never performs any paltform device allocation, thus error path "undo_platform_dev_alloc" is entirely bogus. It drops the reference count from the platform device being probed. If error path is triggered, this will lead to unbalanced device reference counts and premature release of device resources, thus possible use-after-free when releasing remaining devm-managed resources. Fixes: f83fca0 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com> Link: https://lore.kernel.org/r/20240814093957.37940-1-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 72fca83 commit ddfcfeb

File tree

1 file changed

+3
-8
lines changed

1 file changed

+3
-8
lines changed

drivers/usb/dwc3/dwc3-st.c

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -219,10 +219,8 @@ static int st_dwc3_probe(struct platform_device *pdev)
219219
dwc3_data->regmap = regmap;
220220

221221
res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "syscfg-reg");
222-
if (!res) {
223-
ret = -ENXIO;
224-
goto undo_platform_dev_alloc;
225-
}
222+
if (!res)
223+
return -ENXIO;
226224

227225
dwc3_data->syscfg_reg_off = res->start;
228226

@@ -233,8 +231,7 @@ static int st_dwc3_probe(struct platform_device *pdev)
233231
devm_reset_control_get_exclusive(dev, "powerdown");
234232
if (IS_ERR(dwc3_data->rstc_pwrdn)) {
235233
dev_err(&pdev->dev, "could not get power controller\n");
236-
ret = PTR_ERR(dwc3_data->rstc_pwrdn);
237-
goto undo_platform_dev_alloc;
234+
return PTR_ERR(dwc3_data->rstc_pwrdn);
238235
}
239236

240237
/* Manage PowerDown */
@@ -300,8 +297,6 @@ static int st_dwc3_probe(struct platform_device *pdev)
300297
reset_control_assert(dwc3_data->rstc_rst);
301298
undo_powerdown:
302299
reset_control_assert(dwc3_data->rstc_pwrdn);
303-
undo_platform_dev_alloc:
304-
platform_device_put(pdev);
305300
return ret;
306301
}
307302

0 commit comments

Comments
 (0)