Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Chengfeng Ye <cyeaa@connect.ust.hk>
To:     sre@kernel.org
Cc:     linux-kernel@vger.kernel.org, Chengfeng Ye <cyeaa@connect.ust.hk>
Subject: [PATCH] HSI: core: Fix return freed object in hsi_new_client
Date:   Fri,  5 Nov 2021 06:45:07 -0700
Message-Id: <20211105134507.31946-1-cyeaa@connect.ust.hk>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?XRzj9Fx4RviGhZjDt9xmbpC8aDIw612FHSphNvpxcjTWWoOg95dWB94aEb4O?=
 =?us-ascii?Q?oqFjfu1/3OlWR1WE9P3FspjyrkjC8tkO23nUOi7TEzd/BSG0VpzJQ7OgBLvZ?=
 =?us-ascii?Q?AJnzwZLOJmG9qt1w5BjNICT7Jq5ZhyupmN5LxY93HF1ZzW/djOtVZXSokcyZ?=
 =?us-ascii?Q?BhSbojbaH3dnDd1ZADY/ZFV1LX2injhK8o5ICYyGMrq4WrsJESptWjPXK6ii?=
 =?us-ascii?Q?mFN2J5+UXVzQwiGIKxJGXjmych93GXgBec05TnmhPMwMvo6j2vmSdptX/I3J?=
 =?us-ascii?Q?4/6UWoNBikaH2ug3uNp27iNw/m/AvkGis0YvIsC7UWVqZ6WeWXfc+CWhsm0Q?=
 =?us-ascii?Q?DobsZ5EW1s0q3fCn55JC9Nsn3IBhseuTLs9IoEqhsGcWW+59xBDlfq/rfnJA?=
 =?us-ascii?Q?w6qugFvrb2MHnkzTwFAn/gHTUfE9lf0VT5XaZhUXHZvYGbNwAG6EbfMmQbSH?=
 =?us-ascii?Q?LpUnZ4E2aDRsMmV3+0/myoBAtKrLxSsV7HaigYLvDbkl1u3c6nfqqGBNlVTX?=
 =?us-ascii?Q?i7hncFvBAyLZYMrr29vnruZffs2mJrB5kFmcXg+uSEoFCQcCtbXMdERNlZQ+?=
 =?us-ascii?Q?PbT/I+ckQRV00y/D7otWLFwsnffij7fF5ZoUjFGGH9IHvWsF4cMNhHMY8nRp?=
 =?us-ascii?Q?DPcWJcceZF7cUJ/49Eiy5zAUf3FQGhoxXFdpUH2OdtH1PA83UtKlTiWM5WOV?=
 =?us-ascii?Q?rUfu1AEZT6WTW7HPsXAUoR5iq41nFb4yE8Zp6lmBth/CIR+oVKJMPcnLi/Fj?=
 =?us-ascii?Q?R8dmxXvxd8SAUC9Qqlva+4vlehJjYpaonDSL0pZn6ply/j1LaZQB70FLdDPi?=
 =?us-ascii?Q?iPLf6y0t0+dw6+GlmbOtVq5CAefkWbDwJyczEh3vM8p2hVwtGiuc9LDgLVwo?=
 =?us-ascii?Q?9/ol6T/lZBBaxzYAVvwrthQiD3yi5XU9K2WULjkLmROFTVhpvq7+43oDUC9F?=
 =?us-ascii?Q?9oa+S7c92qBoOBY+LRytm5pmARg16D0hm+/yTxHvYDuCWZnNkOkrvb93Zdjn?=
 =?us-ascii?Q?sxO8YgCstNjFo/mAP5kiJtN60RI5O214yFM6X+nG3v0zjBF0bvbXnSPsgL5F?=
 =?us-ascii?Q?7qdCz3dhxUcH/NTpGUL229dqFtITxA22O1iw/lr+BxaMcSCHVKqzdVhqja18?=
 =?us-ascii?Q?pv383aL9q/xexZGfSgiMBJb4dGTfP/S2NNfWkdXTTZYns2+6R4vZInoTp/BG?=
 =?us-ascii?Q?5r1jvs5Dg3bwlQOBoKJUHbttYum93GrLkumq1HabJq/xHwybRBAimjn4JHgu?=
 =?us-ascii?Q?i7/GRJ4huxWEFeixFJNMBfNcwdxRFCRYs0TwZNOJXkbK4NZhG1StOflTo185?=
 =?us-ascii?Q?nR4LJhqoOvwkgiw1v4ws1bgiEKAlG4g7GPMScf2oHK1841NfeJNE7Vd/mLpE?=
 =?us-ascii?Q?+2nkpeRK4I44DAjFbGP78eayu6zDBXiSOSFdgq0glT8LBZ4gYmCdbYNIWv69?=
 =?us-ascii?Q?Rkx6YEwTXRh0bgPpWYlfHiFenMvVBX0fM+ICTYN2zhSIBQiIn1oLvriFXije?=
 =?us-ascii?Q?jB0aY7dMCNphjxucGgXkHZwpDZAlkVhdGn7IJ4NcOOsSGKKJqMkgBWm/RouZ?=
 =?us-ascii?Q?ix4+LtORnGZEQAt/wFfzK56LivYQmr7WWlPVOBdj+9ErPDr6YrqV+/PKWC/6?=
 =?us-ascii?Q?hgS0mAHxoBlCOI8LivNO0ec=3D?=
X-OriginatorOrg: connect.ust.hk
X-MS-Exchange-CrossTenant-Network-Message-Id: 4e018635-286a-4d93-11ff-08d9a0628027
X-MS-Exchange-CrossTenant-AuthSource: TYCP286MB1188.JPNP286.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Nov 2021 13:45:16.9079
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 6c1d4152-39d0-44ca-88d9-b8d6ddca0708
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: jWN+w6NPKFVMMemUaYbiEUZzxG46n5n6hNsTZ/Wnn8olXzK9Rh2r0XpE57iAGF4LaqbbGy73jnVM93HQOYjYOg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYYP286MB0954
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

cl is freed on error of calling device_register, but this
object is return later, which will cause uaf issue. Fix it
by return NULL on error.

Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
---
 drivers/hsi/hsi_core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hsi/hsi_core.c b/drivers/hsi/hsi_core.c
index ec90713564e3..884066109699 100644
--- a/drivers/hsi/hsi_core.c
+++ b/drivers/hsi/hsi_core.c
@@ -102,6 +102,7 @@ struct hsi_client *hsi_new_client(struct hsi_port *port,
 	if (device_register(&cl->device) < 0) {
 		pr_err("hsi: failed to register client: %s\n", info->name);
 		put_device(&cl->device);
+		goto err;
 	}
 
 	return cl;
-- 
2.17.1