Patch "mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()" has been added to the 4.9-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()

to the 4.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     mmc-rtsx_usb_sdmmc-fix-return-value-check-of-mmc_add.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 3293538c3e3a70d6fb41e942f8270c6fe45e0b04
Author: Yang Yingliang <yangyingliang@xxxxxxxxxx>
Date:   Tue Nov 1 14:30:20 2022 +0800

    mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()
    
    [ Upstream commit fc38a5a10e9e5a75eb9189854abeb8405b214cc9 ]
    
    mmc_add_host() may return error, if we ignore its return value, the memory
    that allocated in mmc_alloc_host() will be leaked and it will lead a kernel
    crash because of deleting not added device in the remove path.
    
    So fix this by checking the return value and calling mmc_free_host() in the
    error path, besides, led_classdev_unregister() and pm_runtime_disable() also
    need be called.
    
    Fixes: c7f6558d84af ("mmc: Add realtek USB sdmmc host driver")
    Signed-off-by: Yang Yingliang <yangyingliang@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20221101063023.1664968-7-yangyingliang@xxxxxxxxxx
    Signed-off-by: Ulf Hansson <ulf.hansson@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/mmc/host/rtsx_usb_sdmmc.c b/drivers/mmc/host/rtsx_usb_sdmmc.c
index 6e9c0f8fddb1..817fbf510d1e 100644
--- a/drivers/mmc/host/rtsx_usb_sdmmc.c
+++ b/drivers/mmc/host/rtsx_usb_sdmmc.c
@@ -1355,6 +1355,7 @@ static int rtsx_usb_sdmmc_drv_probe(struct platform_device *pdev)
 #ifdef RTSX_USB_USE_LEDS_CLASS
 	int err;
 #endif
+	int ret;
 
 	ucr = usb_get_intfdata(to_usb_interface(pdev->dev.parent));
 	if (!ucr)
@@ -1391,7 +1392,15 @@ static int rtsx_usb_sdmmc_drv_probe(struct platform_device *pdev)
 	INIT_WORK(&host->led_work, rtsx_usb_update_led);
 
 #endif
-	mmc_add_host(mmc);
+	ret = mmc_add_host(mmc);
+	if (ret) {
+#ifdef RTSX_USB_USE_LEDS_CLASS
+		led_classdev_unregister(&host->led);
+#endif
+		mmc_free_host(mmc);
+		pm_runtime_disable(&pdev->dev);
+		return ret;
+	}
 
 	return 0;
 }