Received-SPF: pass (google.com: domain of linux-kernel+bounces-93935-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
From: Yongzhi Liu <hyperlyzcs@gmail.com>
To: wentong.wu@intel.com,
	gregkh@linuxfoundation.org,
	hdegoede@redhat.com,
	andi.shyti@linux.intel.com
Cc: linux-usb@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	jitxie@tencent.com,
	huntazhang@tencent.com,
	Yongzhi Liu <hyperlyzcs@gmail.com>
Subject: [PATCH] usb: misc: ljca: Fix double free in error handling path
Date: Wed,  6 Mar 2024 21:00:42 +0800
Message-Id: <20240306130042.26811-1-hyperlyzcs@gmail.com>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

When auxiliary_device_add() returns error and then calls
auxiliary_device_uninit(), callback function ljca_auxdev_release
calls kfree(auxdev->dev.platform_data) to free the parameter data
of the function ljca_new_client_device. The callers of
ljca_new_client_device shouldn't call kfree() again
in the error handling path to free the platform data.

Fix this by cleaning up the redundant kfree().

Fixes: acd6199f195d ("usb: Add support for Intel LJCA device")
Signed-off-by: Yongzhi Liu <hyperlyzcs@gmail.com>
---
 drivers/usb/misc/usb-ljca.c | 18 +++---------------
 1 file changed, 3 insertions(+), 15 deletions(-)

diff --git a/drivers/usb/misc/usb-ljca.c b/drivers/usb/misc/usb-ljca.c
index 35770e608c64..be702364be08 100644
--- a/drivers/usb/misc/usb-ljca.c
+++ b/drivers/usb/misc/usb-ljca.c
@@ -590,12 +590,8 @@ static int ljca_enumerate_gpio(struct ljca_adapter *adap)
 		valid_pin[i] = get_unaligned_le32(&desc->bank_desc[i].valid_pins);
 	bitmap_from_arr32(gpio_info->valid_pin_map, valid_pin, gpio_num);
 
-	ret = ljca_new_client_device(adap, LJCA_CLIENT_GPIO, 0, "ljca-gpio",
+	return ljca_new_client_device(adap, LJCA_CLIENT_GPIO, 0, "ljca-gpio",
 				     gpio_info, LJCA_GPIO_ACPI_ADR);
-	if (ret)
-		kfree(gpio_info);
-
-	return ret;
 }
 
 static int ljca_enumerate_i2c(struct ljca_adapter *adap)
@@ -626,13 +622,9 @@ static int ljca_enumerate_i2c(struct ljca_adapter *adap)
 		i2c_info->capacity = desc->info[i].capacity;
 		i2c_info->intr_pin = desc->info[i].intr_pin;
 
-		ret = ljca_new_client_device(adap, LJCA_CLIENT_I2C, i,
+		return ljca_new_client_device(adap, LJCA_CLIENT_I2C, i,
 					     "ljca-i2c", i2c_info,
 					     LJCA_I2C1_ACPI_ADR + i);
-		if (ret) {
-			kfree(i2c_info);
-			return ret;
-		}
 	}
 
 	return 0;
@@ -666,13 +658,9 @@ static int ljca_enumerate_spi(struct ljca_adapter *adap)
 		spi_info->id = desc->info[i].id;
 		spi_info->capacity = desc->info[i].capacity;
 
-		ret = ljca_new_client_device(adap, LJCA_CLIENT_SPI, i,
+		return ljca_new_client_device(adap, LJCA_CLIENT_SPI, i,
 					     "ljca-spi", spi_info,
 					     LJCA_SPI1_ACPI_ADR + i);
-		if (ret) {
-			kfree(spi_info);
-			return ret;
-		}
 	}
 
 	return 0;
-- 
2.36.1