Received-SPF: pass (google.com: domain of linux-kernel+bounces-150354-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
From: Johan Hovold <johan+linaro@kernel.org>
To: Bryan O'Donoghue <bryan.odonoghue@linaro.org>,
	Heikki Krogerus <heikki.krogerus@linux.intel.com>
Cc: Bjorn Andersson <andersson@kernel.org>,
	Konrad Dybcio <konrad.dybcio@linaro.org>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Dmitry Baryshkov <dmitry.baryshkov@linaro.org>,
	linux-arm-msm@vger.kernel.org,
	linux-usb@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	Johan Hovold <johan+linaro@kernel.org>
Subject: [PATCH 0/2] usb: typec: qcom-pmic: fix use-after-free on late probe errors
Date: Thu, 18 Apr 2024 16:57:28 +0200
Message-ID: <20240418145730.4605-1-johan+linaro@kernel.org>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

When reviewing a patch updating the qcom-pmic typec driver, I noticed
that the error handling is broken and can lead to use-after-free.

This series addresses the use-after-free and also fixes the error
handling in the pdphy_start() callback which failed to disable its
supply in all error paths.

The latter fix is not marked for stable on purpose as its not a critical
fix (I'm sure autosel will disagree).

Johan


Johan Hovold (2):
  usb: typec: qcom-pmic: fix use-after-free on late probe errors
  usb: typec: qcom-pmic: fix pdphy start() error handling

 drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c       |  8 ++++++--
 drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c | 11 +++++++----
 2 files changed, 13 insertions(+), 6 deletions(-)

-- 
2.43.2