Patch "ata: libata-transport: fix error handling in ata_tdev_add()" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ata: libata-transport: fix error handling in ata_tdev_add()

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ata-libata-transport-fix-error-handling-in-ata_tdev_.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit b8b51764629b5dbf337faa380a942a86a0be975c
Author: Yang Yingliang <yangyingliang@xxxxxxxxxx>
Date:   Tue Nov 8 21:40:04 2022 +0800

    ata: libata-transport: fix error handling in ata_tdev_add()
    
    [ Upstream commit 1ff36351309e3eadcff297480baf4785e726de9b ]
    
    In ata_tdev_add(), the return value of transport_add_device() is
    not checked. As a result, it causes null-ptr-deref while removing
    the module, because transport_remove_device() is called to remove
    the device that was not added.
    
    Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0
    CPU: 13 PID: 13603 Comm: rmmod Kdump: loaded Tainted: G        W          6.1.0-rc3+ #36
    pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
    pc : device_del+0x48/0x3a0
    lr : device_del+0x44/0x3a0
    Call trace:
     device_del+0x48/0x3a0
     attribute_container_class_device_del+0x28/0x40
     transport_remove_classdev+0x60/0x7c
     attribute_container_device_trigger+0x118/0x120
     transport_remove_device+0x20/0x30
     ata_tdev_delete+0x24/0x50 [libata]
     ata_tlink_delete+0x40/0xa0 [libata]
     ata_tport_delete+0x2c/0x60 [libata]
     ata_port_detach+0x148/0x1b0 [libata]
     ata_pci_remove_one+0x50/0x80 [libata]
     ahci_remove_one+0x4c/0x8c [ahci]
    
    Fix this by checking and handling return value of transport_add_device()
    in ata_tdev_add(). In the error path, device_del() is called to delete
    the device which was added earlier in this function, and ata_tdev_free()
    is called to free ata_dev.
    
    Fixes: d9027470b886 ("[libata] Add ATA transport class")
    Signed-off-by: Yang Yingliang <yangyingliang@xxxxxxxxxx>
    Signed-off-by: Damien Le Moal <damien.lemoal@xxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c
index 5ee46521198d..60f22e1a4943 100644
--- a/drivers/ata/libata-transport.c
+++ b/drivers/ata/libata-transport.c
@@ -683,7 +683,13 @@ static int ata_tdev_add(struct ata_device *ata_dev)
 		return error;
 	}
 
-	transport_add_device(dev);
+	error = transport_add_device(dev);
+	if (error) {
+		device_del(dev);
+		ata_tdev_free(ata_dev);
+		return error;
+	}
+
 	transport_configure_device(dev);
 	return 0;
 }