If allocation fails, the ida_simple_get() will return error number.
So altmode_id_get() may return error number.
And then id will be used in altmode_id_remove, causing the BUG_ON().
Or it will be assigned to alt->id.
Therefore, it should be better to check it and return error if fails,
like the ida_simple_get() in typec_register_port().
Fixes: 8a37d87d72f0 ("usb: typec: Bus type for alternate modes")
Signed-off-by: Jiasheng Jiang <jiasheng@xxxxxxxxxxx>
---
drivers/usb/typec/class.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
index aeef453aa658..67b3670ede99 100644
--- a/drivers/usb/typec/class.c
+++ b/drivers/usb/typec/class.c
@@ -516,6 +516,9 @@ typec_register_altmode(struct device *parent,
struct altmode *alt;
int ret;
+ if (id < 0)
+ return ERR_PTR(id);
+
alt = kzalloc(sizeof(*alt), GFP_KERNEL);
if (!alt) {
altmode_id_remove(parent, id);
--
2.25.1
