Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Subject: Re: [PATCH v3 2/9] usb: typec: Add retimer handle to port
To:     Greg Kroah-Hartman <gregkh@linuxfoundation.org>
CC:     Prashant Malani <pmalani@chromium.org>,
        <linux-kernel@vger.kernel.org>, <linux-usb@vger.kernel.org>,
        <chrome-platform@lists.linux.dev>, <bleung@chromium.org>,
        <heikki.krogerus@linux.intel.com>,
        Daisuke Nojiri <dnojiri@chromium.org>,
        "Dustin L. Howett" <dustin@howett.net>,
        Guenter Roeck <groeck@chromium.org>,
        "Gustavo A. R. Silva" <gustavoars@kernel.org>,
        Kees Cook <keescook@chromium.org>,
        Sebastian Reichel <sebastian.reichel@collabora.com>,
        Tzung-Bi Shih <tzungbi@kernel.org>
References: <20220707222045.1415417-1-pmalani@chromium.org>
 <20220707222045.1415417-3-pmalani@chromium.org>
 <509bf6fe-4406-c577-aa70-6eb70801e375@omp.ru> <Ysf3F3VvmoqCFj4P@kroah.com>
From:   Sergey Shtylyov <s.shtylyov@omp.ru>
Organization: Open Mobile Platform
Message-ID: <fb07d914-b756-1f9d-b670-4d18e84352bb@omp.ru>
Date:   Fri, 8 Jul 2022 12:39:49 +0300
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.10.1
MIME-Version: 1.0
In-Reply-To: <Ysf3F3VvmoqCFj4P@kroah.com>
Content-Type: text/plain; charset="utf-8"
Content-Language: en-US
Content-Transfer-Encoding: 7bit
X-KSE-AttachmentFiltering-Interceptor-Info: protection disabled
X-KSE-Antivirus-Interceptor-Info: scan successful
X-KSE-Antivirus-Info: Clean, bases: 7/8/2022 6:55:00 AM
X-KSE-BulkMessagesFiltering-Scan-Result: InTheLimit
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,NICE_REPLY_A,
        SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 7/8/22 12:21 PM, Greg Kroah-Hartman wrote:
[...]
>>> Similar to mux and orientation switch, add a handle for registered
>>> retimer to the port, so that it has handles to the various switches
>>> connected to it.
>>>
>>> Signed-off-by: Prashant Malani <pmalani@chromium.org>
>>> ---
>>>
>>> Changes since v2:
>>> - No changes.
>>>
>>> Changes since v1:
>>> - Relinquish retimer reference during typec_release.
>>>
>>>  drivers/usb/typec/class.c | 9 +++++++++
>>>  drivers/usb/typec/class.h | 1 +
>>>  2 files changed, 10 insertions(+)
>>>
>>> diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
>>> index 9062836bb638..f08e32d552b4 100644
>>> --- a/drivers/usb/typec/class.c
>>> +++ b/drivers/usb/typec/class.c
>> [...]
>>> @@ -2249,6 +2251,13 @@ struct typec_port *typec_register_port(struct device *parent,
>>>  		return ERR_PTR(ret);
>>>  	}
>>>  
>>> +	port->retimer = typec_retimer_get(&port->dev);
>>> +	if (IS_ERR(port->retimer)) {
>>> +		ret = PTR_ERR(port->retimer);
>>> +		put_device(&port->dev);
>>> +		return ERR_PTR(ret);
>>
>>    Why convert it to and fro, and not just return port->retimer?
> 
> That would be a use-after-free as port might now be gone.

   Ah, indeed!
   It would also ensue an explicit pointer cast...

> thanks,
> 
> greg k-h

MBR, Sergey