From: Hans de Goede <hdegoede@xxxxxxxxxx>
commit 2fae3129c0c08e72b1fe93e61fd8fd203252094a upstream.
x86_android_tablet_remove() frees the pdevs[] array, so it should not
be used after calling x86_android_tablet_remove().
When platform_device_register() fails, store the pdevs[x] PTR_ERR() value
into the local ret variable before calling x86_android_tablet_remove()
to avoid using pdevs[] after it has been freed.
Fixes: 5eba0141206e ("platform/x86: x86-android-tablets: Add support for instantiating platform-devs")
Fixes: e2200d3f26da ("platform/x86: x86-android-tablets: Add gpio_keys support to x86_android_tablet_init()")
Cc: stable@xxxxxxxxxxxxxxx
Reported-by: Aleksandr Burakov <a.burakov@xxxxxxxxxxxx>
Closes: https://lore.kernel.org/platform-driver-x86/20240917120458.7300-1-a.burakov@xxxxxxxxxxxx/
Signed-off-by: Hans de Goede <hdegoede@xxxxxxxxxx>
Link: https://lore.kernel.org/r/20241005130545.64136-1-hdegoede@xxxxxxxxxx
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/platform/x86/x86-android-tablets/core.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/platform/x86/x86-android-tablets/core.c
+++ b/drivers/platform/x86/x86-android-tablets/core.c
@@ -390,8 +390,9 @@ static __init int x86_android_tablet_pro
for (i = 0; i < pdev_count; i++) {
pdevs[i] = platform_device_register_full(&dev_info->pdev_info[i]);
if (IS_ERR(pdevs[i])) {
+ ret = PTR_ERR(pdevs[i]);
x86_android_tablet_remove(pdev);
- return PTR_ERR(pdevs[i]);
+ return ret;
}
}
@@ -443,8 +444,9 @@ static __init int x86_android_tablet_pro
PLATFORM_DEVID_AUTO,
&pdata, sizeof(pdata));
if (IS_ERR(pdevs[pdev_count])) {
+ ret = PTR_ERR(pdevs[pdev_count]);
x86_android_tablet_remove(pdev);
- return PTR_ERR(pdevs[pdev_count]);
+ return ret;
}
pdev_count++;
}
Patches currently in stable-queue which might be from hdegoede@xxxxxxxxxx are
queue-6.10/hid-i2c-hid-ensure-various-commands-do-not-interfere.patch
queue-6.10/platform-x86-isst-fix-the-kasan-report-slab-out-of-bounds-bug.patch
queue-6.10/platform-x86-x86-android-tablets-fix-use-after-free-on-platform_device_register-errors.patch
queue-6.10/power-supply-hwmon-fix-missing-temp1_max_alarm-attribute.patch
queue-6.10/platform-x86-lenovo-ymc-ignore-the-0x0-state.patch
queue-6.10/platform-mellanox-mlxbf-pmc-fix-lockdep-warning.patch
queue-6.10/hid-ignore-battery-for-all-elan-i2c-hid-devices.patch
queue-6.10/acpi-video-add-force_vendor-quirk-for-panasonic-toug.patch
queue-6.10/platform-x86-x86-android-tablets-adjust-xiaomi-pad-2.patch
queue-6.10/platform-x86-amd-pmf-add-quirk-for-tuf-gaming-a14.patch
queue-6.10/platform-x86-touchscreen_dmi-add-nanote-next-quirk.patch
queue-6.10/acpi-ec-do-not-release-locks-during-operation-region.patch
