Patch "ppdev: Add an error check in register_device" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ppdev: Add an error check in register_device

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ppdev-add-an-error-check-in-register_device.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit e0923408d1aa54232cbf59aad7226c2c6e6a31bd
Author: Huai-Yuan Liu <qq810974084@xxxxxxxxx>
Date:   Fri Apr 12 16:38:40 2024 +0800

    ppdev: Add an error check in register_device
    
    [ Upstream commit fbf740aeb86a4fe82ad158d26d711f2f3be79b3e ]
    
    In register_device, the return value of ida_simple_get is unchecked,
    in witch ida_simple_get will use an invalid index value.
    
    To address this issue, index should be checked after ida_simple_get. When
    the index value is abnormal, a warning message should be printed, the port
    should be dropped, and the value should be recorded.
    
    Fixes: 9a69645dde11 ("ppdev: fix registering same device name")
    Signed-off-by: Huai-Yuan Liu <qq810974084@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20240412083840.234085-1-qq810974084@xxxxxxxxx
    Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c
index f6024d97fe70b..a97edbf7455a6 100644
--- a/drivers/char/ppdev.c
+++ b/drivers/char/ppdev.c
@@ -296,28 +296,35 @@ static int register_device(int minor, struct pp_struct *pp)
 	if (!port) {
 		pr_warn("%s: no associated port!\n", name);
 		rc = -ENXIO;
-		goto err;
+		goto err_free_name;
 	}
 
 	index = ida_alloc(&ida_index, GFP_KERNEL);
+	if (index < 0) {
+		pr_warn("%s: failed to get index!\n", name);
+		rc = index;
+		goto err_put_port;
+	}
+
 	memset(&ppdev_cb, 0, sizeof(ppdev_cb));
 	ppdev_cb.irq_func = pp_irq;
 	ppdev_cb.flags = (pp->flags & PP_EXCL) ? PARPORT_FLAG_EXCL : 0;
 	ppdev_cb.private = pp;
 	pdev = parport_register_dev_model(port, name, &ppdev_cb, index);
-	parport_put_port(port);
 
 	if (!pdev) {
 		pr_warn("%s: failed to register device!\n", name);
 		rc = -ENXIO;
 		ida_free(&ida_index, index);
-		goto err;
+		goto err_put_port;
 	}
 
 	pp->pdev = pdev;
 	pp->index = index;
 	dev_dbg(&pdev->dev, "registered pardevice\n");
-err:
+err_put_port:
+	parport_put_port(port);
+err_free_name:
 	kfree(name);
 	return rc;
 }