MIRRORS/linux-imx
1
0
Fork 0
mirror of https://github.com/nxp-imx/linux-imx.git synced 2025-07-06 17:35:20 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

platform/x86: x86-android-tablets: Fix use after free on platform_device_register() errors

Browse Source 
[ Upstream commit 2fae3129c0 ]

x86_android_tablet_remove() frees the pdevs[] array, so it should not
be used after calling x86_android_tablet_remove().

When platform_device_register() fails, store the pdevs[x] PTR_ERR() value
into the local ret variable before calling x86_android_tablet_remove()
to avoid using pdevs[] after it has been freed.

Fixes: 5eba014120 ("platform/x86: x86-android-tablets: Add support for instantiating platform-devs")
Fixes: e2200d3f26 ("platform/x86: x86-android-tablets: Add gpio_keys support to x86_android_tablet_init()")
Cc: stable@vger.kernel.org
Reported-by: Aleksandr Burakov <a.burakov@rosalinux.ru>
Closes: https://lore.kernel.org/platform-driver-x86/20240917120458.7300-1-a.burakov@rosalinux.ru/
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20241005130545.64136-1-hdegoede@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Hans de Goede 2024-10-05 15:05:45 +02:00 committed by Greg Kroah-Hartman
parent 2dbc42f554
commit aac871e493
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/platform/x86/x86-android-tablets/core.c
View File

@ -339,8 +339,9 @@ static __init int x86_android_tablet_probe(struct platform_device *pdev)
for (i = 0; i < pdev_count; i++) { for (i = 0; i < pdev_count; i++) {
pdevs[i] = platform_device_register_full(&dev_info->pdev_info[i]); pdevs[i] = platform_device_register_full(&dev_info->pdev_info[i]);
if (IS_ERR(pdevs[i])) { if (IS_ERR(pdevs[i])) {
ret = PTR_ERR(pdevs[i]);
x86_android_tablet_remove(pdev); x86_android_tablet_remove(pdev);
return PTR_ERR(pdevs[i]); return ret;
} }
} }
@ -388,8 +389,9 @@ static __init int x86_android_tablet_probe(struct platform_device *pdev)
PLATFORM_DEVID_AUTO, PLATFORM_DEVID_AUTO,
&pdata, sizeof(pdata)); &pdata, sizeof(pdata));
if (IS_ERR(pdevs[pdev_count])) { if (IS_ERR(pdevs[pdev_count])) {
ret = PTR_ERR(pdevs[pdev_count]);
x86_android_tablet_remove(pdev); x86_android_tablet_remove(pdev);
return PTR_ERR(pdevs[pdev_count]); return ret;
} }
pdev_count++; pdev_count++;
} }