| Message ID | X8ik4j8yJitVUyfU@mwanda (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | cf5fbe02042e52a5a3d93223770db39002b313c6 |
| Headers | show |
| Series | USB: apple-mfi-fastcharge: Fix use after free in probe | expand |
On Thu, 2020-12-03 at 11:42 +0300, Dan Carpenter wrote: > This code frees "mfi" and then derefences it on the next line to get > the error code. > > Fixes: b0eec52fbe63 ("USB: apple-mfi-fastcharge: Fix kfree after > failed kzalloc") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Thanks for catching that. Reviewed-by: Bastien Nocera <hadess@hadess.net>
diff --git a/drivers/usb/misc/apple-mfi-fastcharge.c b/drivers/usb/misc/apple-mfi-fastcharge.c index 6dedd5498e8a..32a17b42d57b 100644 --- a/drivers/usb/misc/apple-mfi-fastcharge.c +++ b/drivers/usb/misc/apple-mfi-fastcharge.c @@ -178,6 +178,7 @@ static int mfi_fc_probe(struct usb_device *udev) { struct power_supply_config battery_cfg = {}; struct mfi_device *mfi = NULL; + int err; if (!mfi_fc_match(udev)) return -ENODEV; @@ -194,8 +195,9 @@ static int mfi_fc_probe(struct usb_device *udev) &battery_cfg); if (IS_ERR(mfi->battery)) { dev_err(&udev->dev, "Can't register battery\n"); + err = PTR_ERR(mfi->battery); kfree(mfi); - return PTR_ERR(mfi->battery); + return err; } mfi->udev = usb_get_dev(udev);
This code frees "mfi" and then derefences it on the next line to get the error code. Fixes: b0eec52fbe63 ("USB: apple-mfi-fastcharge: Fix kfree after failed kzalloc") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- drivers/usb/misc/apple-mfi-fastcharge.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)