From patchwork Tue Nov 22 12:35:21 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Keeping X-Patchwork-Id: 24345 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp2177929wrr; Tue, 22 Nov 2022 04:45:45 -0800 (PST) X-Google-Smtp-Source: AA0mqf6y3JkKGgX7AqhFZUaeeJIUepS4rVB8zBNGok/umMYgbtuYhZ4mzVJdZk/Q6ee1TACcXMso X-Received: by 2002:a17:90a:df06:b0:212:d299:4758 with SMTP id gp6-20020a17090adf0600b00212d2994758mr31240957pjb.120.1669121144927; Tue, 22 Nov 2022 04:45:44 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669121144; cv=none; d=google.com; s=arc-20160816; b=zaoT4uSzPWNRFy5wjDBTi2klnp99V0b/pC3AUKqKUNq4Vba1pWKe5QGbYPo7zWOAgs F8JY7IoiijyKnAhuJMebdwhs+h091fWzxpfSchWM7FoHGyGVSA4ILLFKiwpUR9jRvuF3 RPtRVgcJSb5ajjoGgCLddoe0WaFyklryNr3B7jW5DpN5tDAsZjCYwFFotWi7HaoyWuoO XCAEOf2hIz0rfBvzesu5JdzlWtu7NJMzBS4+ajOytjn5SK2LPLhCC3B+LPY7A7Ze1lIP mhiA1S9+BWz1aUcvgqUXJeGbVlbqGqlLILZFx0DjTWuTFW+kaZ/wMN6U4W79pXCz6+Mc zYvA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=klbTl7HLzDhjQhMufy4j3EDYOzLDgfBHxVxD7HUlLtI=; b=O2niuXCtNlaJSiqjZCb6IC09k+hQqu8Rd8P2R4rJnjSftRssGkGL4bUrV9SDyiI2ps Hz/mRCbmUIUSw2vdh3DLW1wJvdbik059IcCs+AxD/dkONHtWXbPSAyZjoVR/N653WYXw Vkh6d50jyTnd1r9fLqvvkdhP9tGK9WSzsC4QXE8bqD8f/VzYghhvjSUIAOZQ9zB2kqZd +ipyYmew532wEOtoGjx3kqi8idtCamEKYLkwjQjVLZHUw8smMP/FHZH05pQXnTZfnO7w GkgNy1H7c8HWIMmT/AxgBzQlkdc24rPQwD0zJV8xXEJJZ7l7K932Urt5PbPbOK4MJ7IG OHgg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass (test mode) header.i=@metanate.com header.s=stronger header.b=Ui9NMrKS; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=metanate.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id w3-20020a170902e88300b00188dba5d7dbsi15707200plg.78.2022.11.22.04.45.30; Tue, 22 Nov 2022 04:45:44 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass (test mode) header.i=@metanate.com header.s=stronger header.b=Ui9NMrKS; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=metanate.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232855AbiKVMfp (ORCPT + 99 others); Tue, 22 Nov 2022 07:35:45 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43934 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233373AbiKVMff (ORCPT ); Tue, 22 Nov 2022 07:35:35 -0500 Received: from metanate.com (unknown [IPv6:2001:8b0:1628:5005::111]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 05B685B5B9; Tue, 22 Nov 2022 04:35:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=metanate.com; s=stronger; h=Content-Transfer-Encoding:References: In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Content-Type:Reply-To: Content-ID:Content-Description; bh=klbTl7HLzDhjQhMufy4j3EDYOzLDgfBHxVxD7HUlLtI=; b=Ui9NMrKSmj3G1KD2ytqNoQyqr+ roZDBgCP3u/jG7M04BgVFd571+TCxoRxVgeK6jTAkXvMsPs7ptAx7Yf8RBdzbOh8T5J1He4JtCruI FkM8P+oIK5QiE1/KQZiqorp749Y0ECFETRrjYhXIbEm4dPWPGcRn2nC2c+CVH/w3x5eI9h/GuUtVu xuxTvRSu/84JoykrJADD+worDk5/YOqThfOP0pqYmJUWZwa3FP5EbW3n62oKI8keKhkRVRmycH4X/ 42bJVgWJQaRMv/U9s/rzhSsPhpqfdih4b1k6ImQKbmZOgOsCUeGHi0RjoOPBxUd+gni9A9CApYyMf nZPvgGIQ==; Received: from [81.174.171.191] (helo=donbot.metanate.com) by email.metanate.com with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1oxSUt-0003da-7C; Tue, 22 Nov 2022 12:35:31 +0000 From: John Keeping To: linux-usb@vger.kernel.org Cc: Fabien Chouteau , Peter Korsgaard , Felipe Balbi , Andrzej Pietrasiewicz , linux-kernel@vger.kernel.org, Greg Kroah-Hartman , John Keeping , Lee Jones , Alan Stern Subject: [PATCH 1/3] usb: gadget: f_hid: fix f_hidg lifetime vs cdev Date: Tue, 22 Nov 2022 12:35:21 +0000 Message-Id: <20221122123523.3068034-2-john@metanate.com> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221122123523.3068034-1-john@metanate.com> References: <20221122123523.3068034-1-john@metanate.com> MIME-Version: 1.0 X-Authenticated: YES X-Spam-Status: No, score=-1.3 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RDNS_NONE,SPF_HELO_PASS, SPF_PASS autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1750200373577334611?= X-GMAIL-MSGID: =?utf-8?q?1750200373577334611?= The embedded struct cdev does not have its lifetime correctly tied to the enclosing struct f_hidg, so there is a use-after-free if /dev/hidgN is held open while the gadget is deleted. This can readily be replicated with libusbgx's example programs (for conciseness - operating directly via configfs is equivalent): gadget-hid exec 3<> /dev/hidg0 gadget-vid-pid-remove exec 3<&- Pull the existing device up in to struct f_hidg and make use of the cdev_device_{add,del}() helpers. This changes the lifetime of the device object to match struct f_hidg, but note that it is still added and deleted at the same time. Fixes: 71adf1189469 ("USB: gadget: add HID gadget driver") Signed-off-by: John Keeping Reviewed-by: Andrzej Pietrasiewicz --- drivers/usb/gadget/function/f_hid.c | 52 ++++++++++++++++------------- 1 file changed, 28 insertions(+), 24 deletions(-) diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c index ca0a7d9eaa34..8b8bbeaa27cb 100644 --- a/drivers/usb/gadget/function/f_hid.c +++ b/drivers/usb/gadget/function/f_hid.c @@ -71,7 +71,7 @@ struct f_hidg { wait_queue_head_t write_queue; struct usb_request *req; - int minor; + struct device dev; struct cdev cdev; struct usb_function func; @@ -84,6 +84,14 @@ static inline struct f_hidg *func_to_hidg(struct usb_function *f) return container_of(f, struct f_hidg, func); } +static void hidg_release(struct device *dev) +{ + struct f_hidg *hidg = container_of(dev, struct f_hidg, dev); + + kfree(hidg->set_report_buf); + kfree(hidg); +} + /*-------------------------------------------------------------------------*/ /* Static descriptors */ @@ -904,9 +912,7 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f) struct usb_ep *ep; struct f_hidg *hidg = func_to_hidg(f); struct usb_string *us; - struct device *device; int status; - dev_t dev; /* maybe allocate device-global string IDs, and patch descriptors */ us = usb_gstrings_attach(c->cdev, ct_func_strings, @@ -999,21 +1005,11 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f) /* create char device */ cdev_init(&hidg->cdev, &f_hidg_fops); - dev = MKDEV(major, hidg->minor); - status = cdev_add(&hidg->cdev, dev, 1); + status = cdev_device_add(&hidg->cdev, &hidg->dev); if (status) goto fail_free_descs; - device = device_create(hidg_class, NULL, dev, NULL, - "%s%d", "hidg", hidg->minor); - if (IS_ERR(device)) { - status = PTR_ERR(device); - goto del; - } - return 0; -del: - cdev_del(&hidg->cdev); fail_free_descs: usb_free_all_descriptors(f); fail: @@ -1244,9 +1240,7 @@ static void hidg_free(struct usb_function *f) hidg = func_to_hidg(f); opts = container_of(f->fi, struct f_hid_opts, func_inst); - kfree(hidg->report_desc); - kfree(hidg->set_report_buf); - kfree(hidg); + put_device(&hidg->dev); mutex_lock(&opts->lock); --opts->refcnt; mutex_unlock(&opts->lock); @@ -1256,8 +1250,7 @@ static void hidg_unbind(struct usb_configuration *c, struct usb_function *f) { struct f_hidg *hidg = func_to_hidg(f); - device_destroy(hidg_class, MKDEV(major, hidg->minor)); - cdev_del(&hidg->cdev); + cdev_device_del(&hidg->cdev, &hidg->dev); usb_free_all_descriptors(f); } @@ -1266,6 +1259,7 @@ static struct usb_function *hidg_alloc(struct usb_function_instance *fi) { struct f_hidg *hidg; struct f_hid_opts *opts; + int ret; /* allocate and initialize one new instance */ hidg = kzalloc(sizeof(*hidg), GFP_KERNEL); @@ -1277,17 +1271,27 @@ static struct usb_function *hidg_alloc(struct usb_function_instance *fi) mutex_lock(&opts->lock); ++opts->refcnt; - hidg->minor = opts->minor; + device_initialize(&hidg->dev); + hidg->dev.release = hidg_release; + hidg->dev.class = hidg_class; + hidg->dev.devt = MKDEV(major, opts->minor); + ret = dev_set_name(&hidg->dev, "hidg%d", opts->minor); + if (ret) { + --opts->refcnt; + mutex_unlock(&opts->lock); + return ERR_PTR(ret); + } + hidg->bInterfaceSubClass = opts->subclass; hidg->bInterfaceProtocol = opts->protocol; hidg->report_length = opts->report_length; hidg->report_desc_length = opts->report_desc_length; if (opts->report_desc) { - hidg->report_desc = kmemdup(opts->report_desc, - opts->report_desc_length, - GFP_KERNEL); + hidg->report_desc = devm_kmemdup(&hidg->dev, opts->report_desc, + opts->report_desc_length, + GFP_KERNEL); if (!hidg->report_desc) { - kfree(hidg); + put_device(&hidg->dev); mutex_unlock(&opts->lock); return ERR_PTR(-ENOMEM); } From patchwork Tue Nov 22 12:35:22 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Keeping X-Patchwork-Id: 24346 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp2178149wrr; Tue, 22 Nov 2022 04:46:08 -0800 (PST) X-Google-Smtp-Source: AA0mqf62vmIpQvUONr3Yon92GpRZ4aLImcbqm8dtAF276LI0Vz10546tFqSmEMurCRQ69QlV5bfS X-Received: by 2002:a17:902:c385:b0:186:944a:2560 with SMTP id g5-20020a170902c38500b00186944a2560mr4633425plg.84.1669121168461; Tue, 22 Nov 2022 04:46:08 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669121168; cv=none; d=google.com; s=arc-20160816; b=sH5Ie2u+dSe9fK4pPnbZ9e5p7ioJITDiONBnyG3dTSkHudpNEwQ2phNuajmyRrRYCp /SEQBLtYP/9kaH5aY3WnZ61CtRTVghfx+22BJ49XdXcw0FjRP6Hb6b9+Ln+65pq9v7vr EvO0DX4bxyb0tlj14wtQizpk8TGv+fqE7K6rMDAmiD7LS3Q9zr6ICzdoz8xxNa5mIH/L WAspCKmIYUvZ5ZKesxTQwDI8bDqMSQsonx8uecO4+prAPr1+X1JbC8SpRlPESd3ACmEf P7akdbVakaMNM3Pd+I9/bdpoBwnqRxDjODHjejlZNC3AVmHojrhOTOLK+YYLqf2jlzG7 H0TQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=3XtypsQCZfitCCQMZ1INOCA+bpbOa3aJWCZ30RBSfxk=; b=M78INDlIKLJNkbi98pcgFpwkIH8N8Pg32BG48LiGTdj4N2oj3SZxcNGKUMDUZeJ09a XLsRQoXxTOJxjZlvKwB/7QSMiDlcnKTEJT1LaeXC0PGrFPxP6whz5BN6DGAj+BpwvkLY wZHdBsU9cXMtdIWrfgHlwl4B8loLsmEa0WOcKMFwyvMsAbhOk6EZgqOfsI+15yKHKZAI Dp5hRvgwwA1s7iUei/12cBrxwy0DKyCJP5j1hrszZKm7CUKhxHX7V0+TCpMss99cmX4u PpePv6Ad0mXuKeLhnm9bw8kDs45IUGl/5c9PmeZMO/JqbnKqAAW14lfsVg87Rm0lTzIw bJFw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass (test mode) header.i=@metanate.com header.s=stronger header.b=2rn+vgcs; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=metanate.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id t2-20020a170902b20200b001786b70f913si12708184plr.164.2022.11.22.04.45.53; Tue, 22 Nov 2022 04:46:08 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass (test mode) header.i=@metanate.com header.s=stronger header.b=2rn+vgcs; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=metanate.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233286AbiKVMft (ORCPT + 99 others); Tue, 22 Nov 2022 07:35:49 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43940 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233565AbiKVMff (ORCPT ); Tue, 22 Nov 2022 07:35:35 -0500 Received: from metanate.com (unknown [IPv6:2001:8b0:1628:5005::111]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1814D5B852; Tue, 22 Nov 2022 04:35:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=metanate.com; s=stronger; h=Content-Transfer-Encoding:References: In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Content-Type:Reply-To: Content-ID:Content-Description; bh=3XtypsQCZfitCCQMZ1INOCA+bpbOa3aJWCZ30RBSfxk=; b=2rn+vgcsNJmicNvWa5wF/GIy4x UxlKu5IshzDEjq5aSmeYRYuEs7FD750VvMNtMSQTvXT2rJhUQC17zuVlSHAr02mHxmY+9QfveG2O3 t9qBgfNgAIL6OIdR/9MiCe1HHzWDD2iej2/9sHiRmx5NVTFzBIAR3A3Ig75Sx+So037RT9yJ5z6Gg AOXVnmI0+st2vmoTplh36lbyHddmVEWV1rviobn5ORveSLp79psMWQ2yyAJg9NAd6pfeO+mViB4FT gUYGKdb2efe2Qseg1MnAJMSCKxA4/Hvp3CzfSIRDMJ4xpRwnSRGKQ2eg5afAagbDSyi8pmWK0O9Nq z2leee9A==; Received: from [81.174.171.191] (helo=donbot.metanate.com) by email.metanate.com with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1oxSUt-0003da-Gn; Tue, 22 Nov 2022 12:35:32 +0000 From: John Keeping To: linux-usb@vger.kernel.org Cc: Fabien Chouteau , Peter Korsgaard , Felipe Balbi , Andrzej Pietrasiewicz , linux-kernel@vger.kernel.org, Greg Kroah-Hartman , John Keeping , Lee Jones , Alan Stern Subject: [PATCH 2/3] usb: gadget: f_hid: fix refcount leak on error path Date: Tue, 22 Nov 2022 12:35:22 +0000 Message-Id: <20221122123523.3068034-3-john@metanate.com> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221122123523.3068034-1-john@metanate.com> References: <20221122123523.3068034-1-john@metanate.com> MIME-Version: 1.0 X-Authenticated: YES X-Spam-Status: No, score=-1.3 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RDNS_NONE,SPF_HELO_PASS, SPF_PASS autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1750200398521605534?= X-GMAIL-MSGID: =?utf-8?q?1750200398521605534?= When failing to allocate report_desc, opts->refcnt has already been incremented so it needs to be decremented to avoid leaving the options structure permanently locked. Fixes: 21a9476a7ba8 ("usb: gadget: hid: add configfs support") Signed-off-by: John Keeping Reviewed-by: Andrzej Pietrasiewicz --- drivers/usb/gadget/function/f_hid.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c index 8b8bbeaa27cb..6be6009f911e 100644 --- a/drivers/usb/gadget/function/f_hid.c +++ b/drivers/usb/gadget/function/f_hid.c @@ -1292,6 +1292,7 @@ static struct usb_function *hidg_alloc(struct usb_function_instance *fi) GFP_KERNEL); if (!hidg->report_desc) { put_device(&hidg->dev); + --opts->refcnt; mutex_unlock(&opts->lock); return ERR_PTR(-ENOMEM); } From patchwork Tue Nov 22 12:35:23 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Keeping X-Patchwork-Id: 24344 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp2177702wrr; Tue, 22 Nov 2022 04:45:23 -0800 (PST) X-Google-Smtp-Source: AA0mqf7i5CIOgliSr5onAG8K0lCZb3aElfLeA6wG31kDklvDD8/UhvBc4pCpOm+5dWlMSWtpRNWf X-Received: by 2002:a05:6a00:4286:b0:56d:3de3:c525 with SMTP id bx6-20020a056a00428600b0056d3de3c525mr1378467pfb.41.1669121122797; Tue, 22 Nov 2022 04:45:22 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669121122; cv=none; d=google.com; s=arc-20160816; b=DLQV+vdzD2V9iOaYT5z9LdG1Dp2AwB1T/9vZ7KqARcDtV8mVVQcOcqo8orz6qrCV2E WgqoNHaUzadVTvYZX4GVKDusgwDWDX+mK74Sb8+YPZVYL1Whe12jkH/gBfJEMcU/QQWo oamZwI0nrD7pUEc8X1+AFfaG42BBfZTZ4sa7YG88sl/rDb1tKRIBvYipBE6x5OWp+Opd cjijjuuqGD0cfsBZFkuvk0p87x+RYecAWweBNuKfGw0hKmch1eXkItslaIqf9ZofPKbW oo7/iffYv+GM8tkW3bGxR+eU8KwXGwX8a9g3XSpzfRaeNMDfPncL8m5DKvQb0s+05UXa 6XcQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=VjcwKuzaca86AHSHKpSyWjgTPVgpR5kpdMTz8JABTVY=; b=z4GtgQyBXnOZjDKXg9XRRkfUWvhj9BWNjv8cHKZFLhnW+2xgQVzDcEs1bIVXxjbmvO tvwsuaUfRtzE/ce2rUTL3ZjMHUfU0I/QwKbQ4xuLhtauK5HLdAdTuxKSm4bnUXdfotuE jGYtT6eKr42hYLBQf9PZTlSoakwgWEDDLw0BEOGPrF78brApt28fZLyzlUsDgshELo+s CFsAemH5YPhmrPy7T5paxpC5XGyAqfm9gKdxgj64LgDi5yvuDmq6N/nL/f8fJFb2BMMH hCfLiQi1MTugg+1dLl6TjunVsPnugUDSEwL7I1uCbaRZ16lTieqsed+igXhTiJ9TReUR YfeQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass (test mode) header.i=@metanate.com header.s=stronger header.b=hM6I+fMJ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=metanate.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id w8-20020aa79548000000b0056d8f42a69csi1285697pfq.145.2022.11.22.04.45.08; Tue, 22 Nov 2022 04:45:22 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass (test mode) header.i=@metanate.com header.s=stronger header.b=hM6I+fMJ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=metanate.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233778AbiKVMfj (ORCPT + 99 others); Tue, 22 Nov 2022 07:35:39 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43936 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233204AbiKVMff (ORCPT ); Tue, 22 Nov 2022 07:35:35 -0500 Received: from metanate.com (unknown [IPv6:2001:8b0:1628:5005::111]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0FFA55B849; Tue, 22 Nov 2022 04:35:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=metanate.com; s=stronger; h=Content-Transfer-Encoding:References: In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Content-Type:Reply-To: Content-ID:Content-Description; bh=VjcwKuzaca86AHSHKpSyWjgTPVgpR5kpdMTz8JABTVY=; b=hM6I+fMJWa/70IFhgoLB+YtUW5 vWSJ5OfUrdfleSHIx64eNSpwDZU5bQQ2HobN9HAA7JodXGy9Sz4QleDt88qP79bjgAx3ngTOlLWbg JjTvUCiQPXMe5MBu9Fr8b62VETGbZeEhMv/1VLO9u1ctsonIVRA65EnQ7Ls6sQzaZGQevjf8FVz4c qJsqxwmG4JdQQUOpnEHjZitUXKZXe3j04a+HC0HnTEYxL/halirDjAaqNmB+A48FdzcaStvW8z+z7 FHu5EvI3Ny02TkfNUKF3FSwF3OYZuBWc9NxJWuTHM+S4E9CvqM90xoqCS0C5ApkmYGcG7WOtUmmL9 nJc/A1Fg==; Received: from [81.174.171.191] (helo=donbot.metanate.com) by email.metanate.com with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1oxSUt-0003da-Qx; Tue, 22 Nov 2022 12:35:32 +0000 From: John Keeping To: linux-usb@vger.kernel.org Cc: Fabien Chouteau , Peter Korsgaard , Felipe Balbi , Andrzej Pietrasiewicz , linux-kernel@vger.kernel.org, Greg Kroah-Hartman , John Keeping , Lee Jones , Alan Stern Subject: [PATCH 3/3] usb: gadget: f_hid: tidy error handling in hidg_alloc Date: Tue, 22 Nov 2022 12:35:23 +0000 Message-Id: <20221122123523.3068034-4-john@metanate.com> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221122123523.3068034-1-john@metanate.com> References: <20221122123523.3068034-1-john@metanate.com> MIME-Version: 1.0 X-Authenticated: YES X-Spam-Status: No, score=-1.3 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RDNS_NONE,SPF_HELO_PASS, SPF_PASS autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1750200350396056438?= X-GMAIL-MSGID: =?utf-8?q?1750200350396056438?= Unify error handling at the end of the function, reducing the risk of missing something on one of the error paths. Moving the increment of opts->refcnt later means there is no need to decrement it on the error path and is safe as this is guarded by opts->lock which is held for this entire section. Signed-off-by: John Keeping Reviewed-by: Andrzej Pietrasiewicz --- drivers/usb/gadget/function/f_hid.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c index 6be6009f911e..a8da3b4a2855 100644 --- a/drivers/usb/gadget/function/f_hid.c +++ b/drivers/usb/gadget/function/f_hid.c @@ -1269,18 +1269,14 @@ static struct usb_function *hidg_alloc(struct usb_function_instance *fi) opts = container_of(fi, struct f_hid_opts, func_inst); mutex_lock(&opts->lock); - ++opts->refcnt; device_initialize(&hidg->dev); hidg->dev.release = hidg_release; hidg->dev.class = hidg_class; hidg->dev.devt = MKDEV(major, opts->minor); ret = dev_set_name(&hidg->dev, "hidg%d", opts->minor); - if (ret) { - --opts->refcnt; - mutex_unlock(&opts->lock); - return ERR_PTR(ret); - } + if (ret) + goto err_unlock; hidg->bInterfaceSubClass = opts->subclass; hidg->bInterfaceProtocol = opts->protocol; @@ -1291,14 +1287,13 @@ static struct usb_function *hidg_alloc(struct usb_function_instance *fi) opts->report_desc_length, GFP_KERNEL); if (!hidg->report_desc) { - put_device(&hidg->dev); - --opts->refcnt; - mutex_unlock(&opts->lock); - return ERR_PTR(-ENOMEM); + ret = -ENOMEM; + goto err_put_device; } } hidg->use_out_ep = !opts->no_out_endpoint; + ++opts->refcnt; mutex_unlock(&opts->lock); hidg->func.name = "hid"; @@ -1313,6 +1308,12 @@ static struct usb_function *hidg_alloc(struct usb_function_instance *fi) hidg->qlen = 4; return &hidg->func; + +err_put_device: + put_device(&hidg->dev); +err_unlock: + mutex_unlock(&opts->lock); + return ERR_PTR(ret); } DECLARE_USB_FUNCTION_INIT(hid, hidg_alloc_inst, hidg_alloc);